Unguarded integer divides by timing fields in modeset commit path allow kernel panic
Summary
Five functions divide by stream->timing.pix_clk_khz/h_total/v_total with no zero check: compute_pstate_blackout_duration:1621 total_dest_line_time_ns=1000000UL*h_total/pix_clk_khz. dce110_get_min_vblank_time_us:2476 vertical_blank_time=pixels*1000/pix_clk_khz. pplib_apply_display_requirements:2557 line_time=h_total*1000/pix_clk_khz. build_audio_output:1175 refresh=pix_clk*1000/(h_total*v_total). fill_display_configs:2453 v_refresh/=pix_clk. DC validator only checks upper bounds, never pix_clk_khz==0 or v_total==0. dc_link_validate_mode_timing short-circuits DC_OK when remote_sinks[0] set. Malicious EDID or crafted atomic commit with clock=0 -> #DE panic. Fix: add zero-divisor guards.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1302 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 510 B | view raw |
DF-1302 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: speculative
Finding
Unguarded integer divides by timing fields in modeset commit path allow kernel panic
Source Location
sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:1621-2558
Verdict
Source-confirmed: Unguarded integer divides by timing fields in modeset commit path allo. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
Five functions divide by stream->timing.pix_clk_khz/h_total/v_total with no zero check: compute_pstate_blackout_duration:1621 total_dest_line_time_ns=1000000ULh_total/pix_clk_khz. dce110_get_min_vblank_time_us:2476 vertical_blank_time=pixels1000/pix_clk_khz. pplib_apply_display_requirements:2557 line_time=h_total1000/pix_clk_khz. build_audio_output:1175 refresh=pix_clk1000/(h_total*v_total). fill_display_configs:2453 v_refresh/=pix_clk. DC validator only checks upper bounds, never pix_clk_kh
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: dce110 compute_pstate_blackout_duration divides by stream->timing.pix_clk_khz without zero guard. Added ternary zero guard. HW-gated.
Verified recommended fix
Source-confirmed: dce110 compute_pstate_blackout_duration divides by stream->timing.pix_clk_khz without zero guard. Added ternary zero guard. HW-gated.
Verdict
Source-confirmed: dce110 compute_pstate_blackout_duration divides by stream->timing.pix_clk_khz without zero guard. Added ternary zero guard. HW-gated.
No comments yet.