⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1949

ASSERT-only divide-by-zero guard in fixed-point division panics kernel in production builds

Summary

complete_integer_division_u64 L43-55 guards divisor solely ASSERT(divisor) L50. Production ASSERT=WARN_ON(!(expr)) os_types.h:65-77 emits warning returns without aborting. Then L52 div64_u64_rem(dividend,0,remainder) = raw dividend/0 math64.h:75-80 -> x86 div instruction zero operand #DE -> kernel panic. Reached from dc_fixpt_from_fraction L67 (denominator no zero check); dc_fixpt_recip L210 ASSERT(arg.value) L217; inline dc_fixpt_div/dc_fixpt_div_int fixed31_32.h:329-341. Callers color_gamma.c:92/130/185 dcn10_cm_common.c:342 dce_clock_source.c:698 perform NO zero-divisor validation. Unpriv local user /dev/dri/cardN video group: DRM_MODE_ATOMIC degenerate GAMMA_LUT/CTM region_start<=-33 -> dc_fixpt_pow(2,region_start)=0 -> dc_fixpt_div(y,0) -> panic. Impact: reliable local DoS kernel panic. Fix: if(divisor==0){*remainder=0;return 0;} real guard not ASSERT.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1949 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 529 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.5 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1949 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/drm/amd/display/dc/basics/fixpt31_32.c:43-67. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

amd display DC (not in GENERIC, no AMD HW). Source: complete_integer_division_u64 at L43-55 guards divisor solely ASSERT(divisor) at L50. Production ASSERT=WARN_ON(!(expr)) in os_types.h:65-77 emits warning but returns without aborting. Then L52 div64_u64_rem(dividend,0,remainder) — raw divide-by-zero in math64.h.

Replace ASSERT(divisor) with a real if (divisor == 0) { ...; return 0; } guard.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1949/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Replace ASSERT(divisor) with a real if (divisor == 0) { ...; return 0; } guard. Full git-apply-able diff in findings/poc/DF-1949/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/drm/amd/display/dc/basics/fixpt31_32.c:43-67. amd display DC (not in GENERIC, no AMD HW). complete_integer_division_u64 L43-55 guards divisor solely ASSERT(divisor) L50. Production ASSERT=WARN_ON(!(expr)) os_types.h:65-77 emits warning but does not abort. Then L52 div64_u64_rem(dividend,0,remainder) raw divide-by-zero in math64.h. HW gated.