DF-3612 — Integer divide-by-zero in spread-spectrum programming when VBIOS usSpreadRateInKhz == 0 (si_dpm.c:4831 and :4931)

Severity: Medium Confidence: certain Status: reproduced (harness) Impact: panic

What

radeon_atombios_get_asic_ss_info() copies ss->rate from the VBIOS ASIC_InternalSS_Info entry verbatim and returns true; si_calculate_sclk_params:4831 divides by (reference_divider * ss.rate) and si_populate_mclk_value:4931 divides by ss.rate whenever the SS entry matches the target clock (pi->sclk_ss/pi->mclk_ss set from the same VBIOS table). rate==0 -> div -> #DE -> kernel panic during si_dpm_enable power-state upload. Harness executes the exact expressions in forked children: SIGFPE (signal 4) on both sinks == kernel #DE panic. No AMD GPU on the audit guest for a live trigger.

Reproduce

sh build.sh   # cc -O2 -Wall -o harness harness.c
sh run.sh     # prints [A] buggy-path behaviour, [B] fixed-path behaviour

Expected decisive output (see run.log): the [A] section shows the fault or corruption the kernel would take; the [B] section shows the behaviour with fix.diff applied.

No AMD GPU is attached to the audit QEMU guest (virtio-only), so the radeon DPM path cannot be exercised live; the harness replicates the exact kernel expressions with crafted-VBIOS inputs (house methodology, cf. DF-1137..1140).

Fix

fix.diff — validated: git apply --check clean; make si_dpm.o in sys/dev/drm/radeon with KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC compiles -Werror clean with all five pass-2 fixes stacked; harness [B] shows the primitive gone.

DF-3612 — Verdict

Verdict: REPRODUCED (source-level + harness) — integer divide-by-zero (#DE) panic from crafted-VBIOS SS rate

Same malicious-VBIOS DoS family as DF-1137 (fan t_diff) but a distinct sink pair not covered by it.

Bug confirmation

The SS rate comes straight from the VBIOS with no zero check:

radeon_atombios.c:1543-1548   ss->percentage = le16(usSpreadSpectrumPercentage);
                              ss->type       = ucSpreadSpectrumMode;
                              ss->rate       = le16(usSpreadRateInKhz);   // no check
                              return true;                                // "found"

si_dpm.c then divides by it on every matching state:

si_dpm.c:4829-4832  (si_calculate_sclk_params, pi->sclk_ss)
    if (radeon_atombios_get_asic_ss_info(rdev, &ss, ASIC_INTERNAL_ENGINE_SS, vco_freq)) {
        u32 clk_s = reference_clock * 5 / (reference_divider * ss.rate);   // :4831 #DE
        u32 clk_v = 4 * ss.percentage * fbdiv / (clk_s * 10000);          // :4832 #DE when clk_s==0

si_dpm.c:4929-4932  (si_populate_mclk_value, pi->mclk_ss)
    if (radeon_atombios_get_asic_ss_info(rdev, &ss, ASIC_INTERNAL_MEMORY_SS, freq_nom)) {
        u32 clks = reference_clock * 5 / ss.rate;                          // :4931 #DE

pi->sclk_ss / pi->mclk_ss are enabled by rv770_get_engine_memory_ss (si_dpm.c:7029) from the SAME VBIOS SS tables, so a crafted BIOS that sets the SS-support firmware flag plus a zero-rate entry arms both sinks. The functions run for every performance level of every power state during si_dpm_enable (si_convert_power_level_to_smc -> si_populate_sclk_value / si_populate_mclk_value). On x86-64, div with divisor 0 raises #DE -> kernel panic.

Harness confirmation

run.log:

[A1] engine SS ... child died from SIGFPE (signal 4): integer divide by zero
[A2] memory SS ... child died from SIGFPE (signal 4): integer divide by zero
[B]  rate=0 -> rc=-1 (SS skipped, no trap) ... rate=30 -> rc=0

Trigger conditions (not met on this guest)

SI GPU + radeon DPM (guest is virtio-only) + crafted VBIOS SS entry.

Exploit chain

None — #DE is not steerable; boot-time DoS panic.

Fix

fix.diff — if (ss.rate == 0) return -EINVAL; in both SS blocks. Validation: apply-check OK; make si_dpm.o -Werror clean (stacked); harness [B] no trap, sane-rate path unchanged (rc=0, clk values computed).

fix_status: fixed (compile + harness-level).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.