DF-1274 PoC — tonga spread-spectrum divide-by-zero (LATENT)

Status: source-confirmed real; NOT reproducible on audit guest (no AMD GPU). Impact: divide-by-zero (#DE) panic at powerplay init via crafted VBIOS usSpreadRateInKhz=0. Driver: sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c (amdgpu powerplay, not in GENERIC, no HW). Sibling of DF-1204 (ni_dpm ss.rate).

Reproduce

./build.sh && ./run.sh   # stub; bug path is GPU powerplay init

See VERDICT.md + fix.diff.

DF-1274 — tonga SCLK/MCLK spread-spectrum divide-by-zero (LATENT)

Verdict

NOT REPRODUCED on the audit guest (LATENT / HW-gated). The bug is confirmed real by source-level trace; it cannot fire here because there is no AMD GPU, so the dev/drm/amd/powerplay/smumgr/tonga_smumgr.c path is dead at runtime.

Mechanism (confirmed in source)

• tonga_calculate_sclk_params (tonga_smumgr.c:591): clkS = reference_clock * 5 / (reference_divider * ss_info.speed_spectrum_rate);
• tonga_calculate_mclk_params (tonga_smumgr.c:883): clks = reference_clock * 5 / ss_info.speed_spectrum_rate;
• ss_info.speed_spectrum_rate is loaded directly from the VBIOS field usSpreadRateInKhz (ppatomctrl.c:1248, ssEntry->speed_spectrum_rate = le16_to_cpu(ssInfo->usSpreadRateInKhz);) with no zero check in atomctrl_get_{engine,memory}_clock_spread_spectrum.
• reference_divider = 1 + dividers.uc_pll_ref_div (tonga_smumgr.c:~559) so it is always ≥ 1; the sole zero divisor is ss_info.speed_spectrum_rate.
• A crafted VBIOS with usSpreadRateInKhz == 0 ⇒ integer divide-by-zero (#DE) ⇒ fatal trap / kernel panic at powerplay init.
• Sibling of DF-1204 (ni_dpm ss.rate), same class, fixed the same way.

Why it does not reproduce here

No AMD GPU on the guest; tonga_smumgr attaches only to Tonga/Fiji/Polaris AMD GPUs via powerplay. Reaching the bug needs that hardware + a crafted VBIOS. Valid hard blocker.

Exploit chain

N/A — divide-by-zero DoS (panic), HW-gated (latent). No write primitive.

PoC changes

trigger.c is a documentation stub.

Fix (fix.diff)

Skip spread-spectrum programming when the VBIOS rate is zero, by tightening both if (0 == atomctrl_get_*_clock_spread_spectrum(...)) conditions to also require ss_info.speed_spectrum_rate != 0. Matches the finding proposal ("check rate!=0 before division") and the DF-1204 fix pattern. Applies cleanly (patch -p1 rc=0).

Fix validation

not_testable — code path unreachable on audit guest; diff applies cleanly, syntactically reviewed.