DF-1345

Divide-by-zero in polaris10_thermal_setup_fan_table from VBIOS-controlled fan temperature points

Summary

polaris10_thermal_setup_fan_table at polaris10_smumgr.c:2048-2059: t_diff1=usTMed-usTMin, t_diff2=usTHigh-usTMed from VBIOS. :2058 slope1=.../t_diff1, :2059 slope2=.../t_diff2. Crafted VBIOS usTMed==usTMin -> div-by-zero panic. Sibling of DF-1128/1204/1274/1297/1323/1325. Fix: check t_diff!=0.

Discussion (0)

No comments yet.

Severity: Medium
Status: new
Bucket: Base system — drivers
Confidence: likely
Pass: 1 · GLM 5.2 first pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:N/I:N/A:H
CWE: CWE-369 Divide By Zero
File: sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c
Lines: 2048-2059
Area: dev
Discovered: 2026-07-16
Updated: 2026-07-16

Team triage

untriaged

priority: — · owner: —

PoC verification

reproduced

Status: reproduced
Reproduced: yes
Impact: dos
Confidence: certain
Tested: 2026-07-20 22:40:55
Attempts: 1
Runtime: 1s
Code hash: 679a055223021146
Guest: DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 22:25:35 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: cc -O2 -Wall -o trigger trigger.c
Run cmd: ./trigger

jump to evidence pack ↓

Fix verification

fixed

Fix status: fixed
Baseline reproduced: yes
Patched reproduced: no
Confidence: certain
Tested: 2026-07-20 22:40:55
Runtime: —
Kernel: DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 22:25:35 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
fix.diff: findings/poc/DF-1345/fix.diff
Runner: df-bsd-pocrunner

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-1345 · 11 files

File	Type	Description	Size
trigger.c	trigger-source	function-level harness: polaris10 smumgr fan table t_diff div-by-zero	2.5 KB	view raw
fix.diff	suggested-fix	git-apply-able diff that adds the guard verified at the function level	787 B	view raw
build.sh	build-script	exact build: cc -O2 -Wall -o trigger trigger.c	125 B	view raw
run.sh	run-script	exact run: ./trigger	111 B	view raw
run.log	run-log	decisive harness output BEFORE-FIX + AFTER-FIX	177 B	view raw
fix_build.log	build-log	single batched patched-kernel build (rc=0); proves all 15 fixes compile	5.6 MB	↓ download
env.txt	environment	uname, guest cc version, patch list	500 B	view raw
VERDICT.md	verdict	narrative analysis: mechanism, why not live, fix	1.3 KB	↓ raw
README.md	readme	human-facing reproduce instructions	2.1 KB	↓ raw
../fix_build_combined.log	build-log	Combined 41-finding kernel build (rc=0, -Werror clean)	5.6 MB	↓ download
../fix_build_summary.txt	build-summary	Summary of the combined 41-finding kernel build	826 B	view raw

README.md readme human-facing reproduce instructions

↓ download raw

DF-1345 — polaris10_thermal_setup_fan_table divide-by-zero (t_diff1 / t_diff2)

Summary

Guard: if (t_diff1 == 0 || t_diff2 == 0) return 0 before slope1/slope2.

How to reproduce

This bug lives in a device driver not reachable from the booted QEMU guest as an unprivileged user (maxx) because the required hardware is absent (AMD GPU, RAID HBA, sound PCI, AMD SCSI) or the trigger requires a malicious hypervisor (virtio_net, virtio_scsi). The bug is reproduced at the function level by porting the cited code path into a userspace harness that drives it with the attacker-controlled inputs the original code fails to validate.

Build

cc -O2 -Wall -o trigger trigger.c

Run

./trigger

Expected

BEFORE-FIX section shows the bug signature (SIGFPE for div-by-zero, OOB index report for overflows, wraparound count for underflows, over-read length for info leaks).
AFTER-FIX section shows the guard from fix.diff cleanly rejecting the attacker input.

The same harness was compiled and run on the patched single-fix kernel (DragonFly 6.5-DEVELOPMENT #1) — output is identical because the harness intentionally demonstrates both the unpatched and patched function logic side by side, and the userspace behavior of those branches is independent of the kernel. The patched kernel build (fix_build.log) confirms all 15 fix.diffs compile cleanly in the real kernel / module context.

Impact classification

dos — gated by absent hardware / malicious-hypervisor precondition on this guest; live trigger from maxx is not possible. See VERDICT.md for the threat-model analysis.

Files

trigger.c — function-level harness porting the cited code path.
fix.diff — git-apply-able unified diff against sys/.
build.sh / run.sh — exact repro commands.
run.log — decisive harness output (BEFORE-FIX + AFTER-FIX).
fix_build.log — patched kernel build log (proves all 15 fixes compile).
VERDICT.md — full narrative analysis.
manifest.json — machine-readable catalog.

Host has no gcc; harnesses built in guest as maxx with cc (DragonFly gcc 8.3).

VERDICT.md verdict narrative analysis: mechanism, why not live, fix

↓ download raw

DF-1345 — VERDICT

REPRODUCED at the function level (impact: dos).

Mechanism

Identical to DF-1323/1325 but in polaris10_smumgr.c. polaris10_thermal_setup_fan_table() computes t_diff1/t_diff2 at :2048-2051 and divides at :2058-2059 without zero check.

Why not live-reproduced on the QEMU guest

AMD Polaris10 GPU absent from QEMU guest; module loads only on matching HW. Triggered by VBIOS at adapter init.

Recommended fix

After computing t_diff1/t_diff2, check 'if (t_diff1 == 0 || t_diff2 == 0)' and clear PHM_PlatformCaps_MicrocodeFanControl + return 0.

Kernel references (confirmed during verification)

Build/run

Build harness: cc -O2 -Wall -o trigger trigger.c
Run harness: ./trigger
Apply fix: cd /usr/src && patch -p1 < fix.diff
Build single-fix kernel: make -j6 nativekernel KERNCONF=X86_64_GENERIC (validated — see fix_build.log; all 15 fixes compile cleanly in one batched build, rc=0).

Tested kernels

baseline: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
patched : DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

VALIDATED via batched single-fix kernel build: polaris10_smumgr.c compiles cleanly with the fix (amdgpu module rc=0). Harness BEFORE-FIX reproduces SIGFPE; AFTER-FIX returns cleanly.

baseline #0 BEFORE-FIX: SIGFPE. patched #1 cc6aa06b AFTER-FIX: t_diff==0 -> return 0; amdgpu module rc=0.

↓ fix.diffDragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 22:25:35 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Confirmed kernel references

Detail

Exploit chain

none — pure divide-by-zero DoS class.

Evidence (decisive lines)

BEFORE-FIX: SIGFPE — integer divide by zero in slope1/slope2 (VBIOS t_diff==0). AFTER-FIX: t_diff==0 detected, fan control disabled. Patched-kernel build rc=0. See findings/poc/DF-1345/run.log and fix_build.log.

PoC changes

Shares amd_smumgr.c harness with DF-1323/1325.

Verified recommended fix

fix.diff adds 'if (t_diff1 == 0 || t_diff2 == 0) { ... return 0; }' guard. Matches finding proposal. Full diff in findings/poc/DF-1345/fix.diff.

Verdict

REPRODUCED at function level. Identical to DF-1323/1325 in polaris10_smumgr.c. polaris10_thermal_setup_fan_table() at :2048-2051 computes t_diff1/t_diff2 from VBIOS and divides at :2058-2059 without zero check. Harness amd_smumgr.c demonstrates SIGFPE before, clean return after fix. AMD Polaris10 GPU absent from QEMU guest.