DF-1245 — Divide-by-zero DoS in evergreen_cs_track_validate_cb via CB_COLOR_PITCH

Verdict

SOURCE-CONFIRMED (real bug), INCONCLUSIVE at runtime — the radeon.ko module is not loaded (no AMD Evergreen GPU in the QEMU guest) and is not compiled into the GENERIC kernel, so the divide-by-zero path is dormant. Fix authored and compile-validated.

Mechanism (source trace)

The radeon DRM command-submission parser stores the raw user IB dword for CB_COLORn_PITCH unmasked into the track state, unlike the depth and texture paths which mask first:

• sys/dev/drm/radeon/evergreen_cs.c:1396 — track->cb_color_pitch[tmp] = radeon_get_ib_value(p, idx); (raw 32-bit, no & PITCH_TILE_MAX mask). Compare: the depth path uses G_028058_PITCH_TILE_MAX (11-bit, evergreen_cs.c:568); the texture path uses G_030000_PITCH (12-bit). The CB color path has no equivalent mask.
• sys/dev/drm/radeon/evergreen_cs.c:401-404: pitch = track->cb_color_pitch[id]; /* unsigned, raw */ slice = track->cb_color_slice[id]; surf.nbx = (pitch + 1) * 8; surf.nby = ((slice + 1) * 64) / surf.nbx; /* DIVIDE BY ZERO if nbx==0 */
• If a DRM_AUTH client submits CB_COLORn_PITCH = 0xFFFFFFFF, then (pitch+1)*8 = 0 (32-bit wrap) and the division at line 404 faults with a kernel #DE (divide error) → panic.

Why not reproduced at runtime

• radeon.ko is not loaded on the guest (kldstat shows only kernel + ehci.ko + xhci.ko) and is not in X86_64_GENERIC (no device radeon in the kernel config).
• Requires an AMD Evergreen-class (Radeon HD 5xxx/6xxx) GPU attached; the QEMU guest uses -vga none/stdvga, no AMD GPU.
• Requires DRM_AUTH (an authenticated DRM client, i.e. a local X user). This is a local DoS via GPU command submission, reachable only on systems with the affected hardware.

Fix (fix.diff, compile-validated)

Guard surf.nbx == 0 before the division, returning -EINVAL (matching the existing dev_warn + return -EINVAL pattern used elsewhere in the function). The patched evergreen_cs.c compiles cleanly with gcc 8.3, -Werror, no warnings.

Realistic impact ceiling

Local kernel panic (DoS) by a DRM-authenticated user on a machine with an AMD Evergreen GPU. No memory-corruption primitive — purely a divide-by-zero fault. On this guest: not reachable (no AMD GPU).