intel_dsi_vbt: integer overflow in DSI timing math writes wrong DPHY/Hs-to-Lp register values
Summary
intel_dsi_vbt_init performs burst-mode-ratio and bitrate calculations in u32. Line 566 computed_ddr=(pclk*bpp)/lane_count. 574-576 burst_mode_ratio=DIV_ROUND_UP(target_burst_mode_freq*100,computed_ddr) target unbounded VBT. 578 pclk=DIV_ROUND_UP(pclk*burst_mode_ratio,100) pclk up to ~600K * ratio u16 65535 = ~4e10 overflows u32 max 4.3e9. 589 bitrate=(pclk*bpp)/lane_count uses corrupt pclk. 648/656/676/687 ths_prepare_ns*ui_den multiply by huge bitrate overflow u32. Clamps catch only field-max not underflow. Result: garbage DPHY registers dphy_reg lp_byte_clk hs_to_lp_count clk_lp/hs_to_lp_count written to MMIO. VBT firmware attacker. Fix: widen to u64.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1772 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Widen critical multiplications to u64. | 773 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1772 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/i915/intel_dsi_vbt.c:566-578.
Mechanism
intel_dsi_vbt_init burst-mode-ratio and bitrate calculations in u32 overflow: pclk*burst_mode_ratio with large VBT values exceeds u32 max, producing garbage DPHY registers.
Fix
Widen critical multiplications to u64.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
i915 sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- i
- 9
- 1
- 5
- /
- i
- n
- t
- e
- l
- _
- d
- s
- i
- _
- v
- b
- t
- .
- c
- :
- 5
- 6
- 6
- -
- 5
- 7
- 8
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/i915/intel_dsi_vbt.c:566-578. Fix compiled clean.
PoC changes
authored fix.diff: widen critical multiplications to u64
Verified recommended fix
Widen burst-mode multiplications to u64. Matches finding proposal.
Verdict
REPRODUCED (source-only). Burst-mode-ratio math in u32 overflows with large VBT values; garbage DPHY registers.
No comments yet.