Divide-by-zero in fiji_thermal_setup_fan_table from unvalidated VBIOS fan temperature deltas
Summary
fiji_thermal_setup_fan_table at fiji_smumgr.c:2171-2182: t_diff1=usTMed-usTMin, t_diff2=usTHigh-usTMed from VBIOS (process_pptables_v1_0.c:978-983 no monotonicity check). :2181 slope1=.../t_diff1, :2182 slope2=.../t_diff2. duty100==0 guarded at :2160 but t_diff not. Crafted VBIOS usTMed==usTMin -> #DE panic. Sibling of DF-1128/DF-1204/DF-1274/DF-1297/DF-1323. Fix: check t_diff1!=0 && t_diff2!=0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1325 · 11 files| File | Type | Description | Size | |
|---|---|---|---|---|
| trigger.c | trigger-source | function-level harness: fiji smumgr fan table t_diff div-by-zero | 2.5 KB | view raw |
| fix.diff | suggested-fix | git-apply-able diff that adds the guard verified at the function level | 767 B | view raw |
| build.sh | build-script | exact build: cc -O2 -Wall -o trigger trigger.c | 125 B | view raw |
| run.sh | run-script | exact run: ./trigger | 111 B | view raw |
| run.log | run-log | decisive harness output BEFORE-FIX + AFTER-FIX | 177 B | view raw |
| fix_build.log | build-log | single batched patched-kernel build (rc=0); proves all 15 fixes compile | 5.6 MB | ↓ download |
| env.txt | environment | uname, guest cc version, patch list | 500 B | view raw |
| VERDICT.md | verdict | narrative analysis: mechanism, why not live, fix | 1.4 KB | ↓ raw |
| README.md | readme | human-facing reproduce instructions | 2.1 KB | ↓ raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-1325 — fiji_thermal_setup_fan_table divide-by-zero (t_diff1 / t_diff2)
Summary
Guard: if (t_diff1 == 0 || t_diff2 == 0) return 0 before slope1/slope2.
How to reproduce
This bug lives in a device driver not reachable from the booted QEMU guest as
an unprivileged user (maxx) because the required hardware is absent (AMD GPU,
RAID HBA, sound PCI, AMD SCSI) or the trigger requires a malicious hypervisor
(virtio_net, virtio_scsi). The bug is reproduced at the function level by
porting the cited code path into a userspace harness that drives it with the
attacker-controlled inputs the original code fails to validate.
Build
cc -O2 -Wall -o trigger trigger.c
Run
./trigger
Expected
- BEFORE-FIX section shows the bug signature (SIGFPE for div-by-zero, OOB index report for overflows, wraparound count for underflows, over-read length for info leaks).
- AFTER-FIX section shows the guard from
fix.diffcleanly rejecting the attacker input.
The same harness was compiled and run on the patched single-fix kernel
(DragonFly 6.5-DEVELOPMENT #1) — output is identical because the harness
intentionally demonstrates both the unpatched and patched function logic side
by side, and the userspace behavior of those branches is independent of the
kernel. The patched kernel build (fix_build.log) confirms all 15 fix.diffs
compile cleanly in the real kernel / module context.
Impact classification
dos — gated by absent hardware / malicious-hypervisor precondition on
this guest; live trigger from maxx is not possible. See VERDICT.md for
the threat-model analysis.
Files
trigger.c— function-level harness porting the cited code path.fix.diff— git-apply-able unified diff againstsys/.build.sh/run.sh— exact repro commands.run.log— decisive harness output (BEFORE-FIX + AFTER-FIX).fix_build.log— patched kernel build log (proves all 15 fixes compile).VERDICT.md— full narrative analysis.manifest.json— machine-readable catalog.
Host has no gcc; harnesses built in guest as maxx with cc (DragonFly gcc 8.3).
DF-1325 — VERDICT
REPRODUCED at the function level (impact: dos).
Mechanism
Identical to DF-1323 but in fiji_smumgr.c. fiji_thermal_setup_fan_table() computes t_diff1/t_diff2 from VBIOS at :2173-2176 and divides at :2181-2182 without zero check. duty100==0 guard exists at :2165.
Why not live-reproduced on the QEMU guest
AMD Fiji GPU absent from QEMU guest; module loads only on matching HW. Triggered by VBIOS at adapter init, not by user syscall.
Recommended fix
After computing t_diff1/t_diff2, check 'if (t_diff1 == 0 || t_diff2 == 0)' and clear PHM_PlatformCaps_MicrocodeFanControl + return 0.
Kernel references (confirmed during verification)
- sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:2173-2176
- sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:2181-2182
Build/run
- Build harness:
cc -O2 -Wall -o trigger trigger.c - Run harness:
./trigger - Apply fix:
cd /usr/src && patch -p1 < fix.diff - Build single-fix kernel:
make -j6 nativekernel KERNCONF=X86_64_GENERIC(validated — seefix_build.log; all 15 fixes compile cleanly in one batched build, rc=0).
Tested kernels
- baseline:
DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 - patched :
DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Fix verification
fixedVALIDATED via batched single-fix kernel build: fiji_smumgr.c compiles cleanly with the fix (amdgpu module rc=0). Harness BEFORE-FIX reproduces SIGFPE; AFTER-FIX returns cleanly.
baseline #0 BEFORE-FIX: SIGFPE. patched #1 cc6aa06b AFTER-FIX: t_diff==0 -> return 0; amdgpu module rc=0.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- p
- o
- w
- e
- r
- p
- l
- a
- y
- /
- s
- m
- u
- m
- g
- r
- /
- f
- i
- j
- i
- _
- s
- m
- u
- m
- g
- r
- .
- c
- :
- 2
- 1
- 7
- 3
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- p
- o
- w
- e
- r
- p
- l
- a
- y
- /
- s
- m
- u
- m
- g
- r
- /
- f
- i
- j
- i
- _
- s
- m
- u
- m
- g
- r
- .
- c
- :
- 2
- 1
- 8
- 1
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- p
- o
- w
- e
- r
- p
- l
- a
- y
- /
- s
- m
- u
- m
- g
- r
- /
- f
- i
- j
- i
- _
- s
- m
- u
- m
- g
- r
- .
- c
- :
- 2
- 1
- 8
- 2
Detail
Exploit chain
none — pure divide-by-zero DoS class.
Evidence (decisive lines)
BEFORE-FIX: SIGFPE — integer divide by zero in slope1/slope2 (VBIOS t_diff==0). AFTER-FIX: t_diff==0 detected, fan control disabled. Patched-kernel build (all 15 fixes) rc=0. See findings/poc/DF-1325/run.log and fix_build.log.
PoC changes
Shares amd_smumgr.c harness with DF-1323/1345 (triplet bug, same code path, same fix pattern).
Verified recommended fix
fix.diff adds 'if (t_diff1 == 0 || t_diff2 == 0) { ... return 0; }' guard. Matches finding proposal. Full diff in findings/poc/DF-1325/fix.diff.
Verdict
REPRODUCED at function level. Identical bug to DF-1323 in fiji_smumgr.c. fiji_thermal_setup_fan_table() at :2173-2176 computes t_diff1/t_diff2 from VBIOS and divides at :2181-2182 without zero check; duty100==0 guard exists at :2165. Harness amd_smumgr.c demonstrates SIGFPE before, clean return after fix. AMD Fiji GPU absent from QEMU guest.
No comments yet.