Display scaling math divides by stream/plane rect dimensions with no zero guard (kernel #DE panic)
Summary
calculate_scaling_ratios/recout/viewport at dc_resource.c: div64_s64 and int divisions by stream->src/dst.width/height and plane dst_rect.width/height with NO zero check. div64_s64 is plain dividend/divisor. resource_build_scaling_params calls calculate_scaling_ratios BEFORE the only size sanity check. Currently bounded: amdgpu_dm rejects zero rects, underscan capped at 128 < h/v_addressable. Speculative: future path bypassing rect validation -> #DE panic. Fix: add zero-rect guard at top of resource_build_scaling_params.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1301 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 1.6 KB | view raw |
DF-1301 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: speculative
Finding
Display scaling math divides by stream/plane rect dimensions with no zero guard (kernel #DE panic)
Source Location
sys/dev/drm/amd/display/dc/core/dc_resource.c:635-755
Verdict
Source-confirmed: Display scaling math divides by stream/plane rect dimensions with no z. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
calculate_scaling_ratios/recout/viewport at dc_resource.c: div64_s64 and int divisions by stream->src/dst.width/height and plane dst_rect.width/height with NO zero check. div64_s64 is plain dividend/divisor. resource_build_scaling_params calls calculate_scaling_ratios BEFORE the only size sanity check. Currently bounded: amdgpu_dm rejects zero rects, underscan capped at 128 < h/v_addressable. Speculative: future path bypassing rect validation -> #DE panic. Fix: add zero-rect guard at top of reso
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: dc_resource scaling math divides by stream->src.width/height without zero guard, kernel #DE panic. Added ternary zero guard. HW-gated.
Verified recommended fix
Source-confirmed: dc_resource scaling math divides by stream->src.width/height without zero guard, kernel #DE panic. Added ternary zero guard. HW-gated.
Verdict
Source-confirmed: dc_resource scaling math divides by stream->src.width/height without zero guard, kernel #DE panic. Added ternary zero guard. HW-gated.
No comments yet.