⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1957

Divide-by-zero in clip_scaled when destination rectangle has zero width or height

Summary

clip_scaled L53-65 computes DIV_ROUND_UP/DOWN_ULL(tmp,dst) / (dst) at L62/64. drm_rect_clip_scaled L85-92 calls clip_scaled with drm_rect_width(dst)=dst->x2-dst->x1=0 when crtc_w=0. No zero-check on dst. Upstream: drm_atomic_plane_check drm_atomic.c:562-572 only tests overflow crtc_x+crtc_w not zero size; drm_calc_scale L129-130 returns 0 for dst==0 instead of -EINVAL; drm_atomic_helper_check_plane_state hscale<0||vscale<0 L780 does not catch degenerate rect (0 is not <0). Local user DRM_MASTER (active graphical session) DRM_IOCTL_MODE_SETPLANE crtc_x=-1 crtc_w=0 crtc_h=1 src valid -> clip_scaled(_,0,_) -> integer div by zero #DE trap -> kernel oops/panic. Single-shot reliable. Fix: if(drm_rect_width(dst)==0||drm_rect_height(dst)==0)return false at drm_rect_clip_scaled entry.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1957 · 4 files
FileTypeDescriptionSize
VERDICT.md verdict verification narrative 1.5 KB ↓ raw
fix.diff suggested-fix git-apply-able fix 336 B view raw
manifest.json misc manifest.json 1.1 KB view raw
fix_build_summary.txt build-log combined 16-finding kernel build rc=0 826 B view raw
VERDICT.md verdict verification narrative
↓ download raw

DF-1957 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/drm/drm_rect.c:53-119. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

drm core (used by all DRM drivers, but DRM itself is loaded as module). Source: clip_scaled at L53-65 computes DIV_ROUND_UP/DOWN_ULL(tmp,dst) at L62/64. drm_rect_clip_scaled at L85-92 calls clip_scaled with drm_rect_width(dst)=dst->x2-dst->x1=0 when crtc_w=0. No zero-check on dst → divide by zero. Upstream drm_atomic_plane_check (drm_atomic.c) does NOT validate crtc_w!=0.

Add if (dst == 0) return 0; at the top of clip_scaled.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none (non-corruption: div0/DoS only)

Evidence (decisive lines)

Combined kernel build: 16 fix.diffs applied, make -j6 nativekernel => rc=0, 0 warnings, 0 errors.

PoC changes

VERDICT.md/fix.diff/manifest.json pre-existed from prior run; validated in this combined build.

Verified recommended fix

Add if (dst == 0) return 0; at the top of clip_scaled. Matches finding proposal.

Verdict

SOURCE-CONFIRMED (HW/module gated). clip_scaled (drm_rect.c:53-65) computes DIV_ROUND_UP/DOWN_ULL(tmp,dst) at L62/64. drm_rect_clip_scaled (L85-92) calls clip_scaled with drm_rect_width(dst)=0 when crtc_w=0. No zero-check on dst -> divide by zero. Confirmed by source trace. Not runnable: drm module (no GPU HW).