Divide-by-zero panic when VBIOS supplies zero SCLK or zero spread-spectrum rate
Summary
rv6xx_program_memory_timing_parameters at rv6xx_dpm.c:811-814: 64*high_clock/sclks[LOW/MEDIUM/HIGH]. sclks from VBIOS usEngineClock (no zero check). Also rv6xx_calculate_spread_spectrum_clk_s :546 (ref_freq*10)/(ss_rate*2) where ss_rate from VBIOS. mclk_ss path live when ASIC_INTERNAL_MEMORY_SS advertised. Sibling of DF-1334/1386/1387. Crafted VBIOS. Fix: guard all divisors !=0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1392 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add zero-check guards before all divisions by VBIOS-derived clock values. | 747 B | view raw |
| VERDICT.md | verdict | Full source-trace analysis | 2.2 KB | ↓ raw |
| build.sh | build-script | Kernel build validation | 535 B | view raw |
| run.sh | run-script | PoC runner (not runnable on guest) | 676 B | view raw |
| fix_build.log | build-log | Full kernel build output (make nativekernel rc=0) | 5.6 MB | ↓ download |
| env.txt | environment | Guest environment | 277 B | view raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-1392 — Verification Verdict
Verdict: CONFIRMED-BY-SOURCE-TRACE (HW-gated)
Status: inconclusive (HW-gated / not reachable as unprivileged maxx) Impact: none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only) Confidence: certain (source-trace confirmed bug is real)
Mechanism
rv6xx_program_memory_timing_parameters at :811-814 computes sqm_ratio = 64high_clock/sclks[LOW|MEDIUM|HIGH]. sclks[] are populated from VBIOS usEngineClock (no zero check). If any sclk==0, #DE div-by-zero panic. Also rv6xx_calculate_spread_spectrum_clk_s at :546 computes (ref_freq10)/(ss_rate*2) where ss_rate from VBIOS — ss_rate==0 causes #DE. The mclk_ss path is live when ASIC_INTERNAL_MEMORY_SS is advertised.
Source: sys/dev/drm/radeon/rv6xx_dpm.c:811-814, 546
Why it cannot be reproduced on this guest
HW-gated. radeon.ko is a loadable module (not in GENERIC); requires ATI/AMD radeon GPU hardware (RV6xx/RV7xx ASIC). No GPU in QEMU guest. Module is not loaded and no device node exists.
Phase 6: Escalation Assessment
This is a HW-gated GPU module (radeon DPM) finding. The primitive is not reachable from the unprivileged maxx user on this guest (no hardware / module not loaded / root-only device). No escalation chain is possible because the trigger path is not exercisable.
For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest. For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx (uid 1001) has no operator group membership.
Fix
Guard all divisors: return early if any sclk==0 before sqm_ratio; return 0 if ss_rate==0 in calculate_spread_spectrum_clk_s.
Fix description: Add zero-check guards before all divisions by VBIOS-derived clock values.
The full git-apply-able diff is in fix.diff. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via make nativekernel rc=0).
Classification
- status: inconclusive
- reproduced: 0
- impact: none
- fix_status: not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- r
- a
- d
- e
- o
- n
- /
- r
- v
- 6
- x
- x
- _
- d
- p
- m
- .
- c
- :
- 8
- 1
- 1
- -
- 8
- 1
- 4
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- r
- a
- d
- e
- o
- n
- /
- r
- v
- 6
- x
- x
- _
- d
- p
- m
- .
- c
- :
- 5
- 4
- 6
Detail
Exploit chain
none (div-by-zero DoS class — no write primitive, VBIOS-triggered, HW-gated)
Evidence (decisive lines)
Source trace: rv6xx_dpm.c:811 'STATE0(64 * high_clock / pi->hw.sclks[R600_POWER_LEVEL_LOW])' — no zero guard. radeon.ko not in kldstat, no GPU in QEMU.
PoC changes
Authored fix.diff: guard ss_rate==0 in calculate_spread_spectrum_clk_s; return early if any sclk==0 in program_memory_timing_parameters.
Verified recommended fix
Add zero-check guards before all divisions by VBIOS-derived clock values. supersedes finding proposal. Full diff in findings/poc/DF-1392/fix.diff.
Verdict
CONFIRMED BY SOURCE TRACE. rv6xx_program_memory_timing_parameters at rv6xx_dpm.c:811-814 computes sqm_ratio = 64high_clock/sclks[LOW|MEDIUM|HIGH]; sclks from VBIOS usEngineClock with no zero check — div-by-zero #DE. Also rv6xx_calculate_spread_spectrum_clk_s at :546 divides by (ss_rate2) with no guard. Bug is real but HW-gated: radeon.ko is a loadable module requiring ATI/AMD RV6xx GPU hardware absent from QEMU guest. Module not loaded, no device.
No comments yet.