DF-3647 — Integer divide-by-zero in spread-spectrum programming when the VBIOS SS rate is 0 (ci_calculate_mclk_params / ci_calculate_sclk_params)

File: sys/dev/drm/radeon/ci_dpm.c (pass 2, GLM 5.3 re-audit) Severity: Medium | CWE-369 Divide By Zero | confidence: certain

Reproduce

This pack carries a userland logic harness (harness.c) built and run ON THE AUDIT GUEST with the exact kernel types; decisive section: [B]

./build.sh
./run.sh

Expected decisive line: SIGFPE (kernel: #DE panic)

The kernel code path itself requires a Sea Islands radeon GPU + crafted VBIOS; the guest is virtio-only (no AMD PCI device, no /dev/dri, no drm kld) — see env.txt.

Full narrative: VERDICT.md. Proposed fix: fix.diff (authored against the read-only sys/ tree; never applied there).

DF-3647 — verdict narrative

Finding

Integer divide-by-zero in spread-spectrum programming when the VBIOS SS rate is 0 (ci_calculate_mclk_params / ci_calculate_sclk_params)

Kernel references

• sys/dev/drm/radeon/ci_dpm.c:2876
• sys/dev/drm/radeon/ci_dpm.c:3221
• sys/dev/drm/radeon/ci_dpm.c:3227
• sys/dev/drm/radeon/radeon_atombios.c:1546
• sys/dev/drm/radeon/ci_dpm.c:5953

Was it reproduced?

No — not on the kernel path. The audit guest is virtio-only (0 AMD PCI devices, /dev/dri absent, no radeon/drm kld; env.txt), so sys/dev/drm/radeon/ci_dpm.c can never execute there. Per the pass-2 instruction for this hardware-gated file, the verdict is inconclusive (source-level certainty certain) rather than reproduced.

Logic-level proof (guest harness)

harness.c models the exact loop/index/division with the exact kernel types and was compiled and executed on the audit guest (cc -O2 -Wall, DragonFly 6.5-DEVELOPMENT). Decisive output, stable across 2 runs (run.log, run.2.log):

SIGFPE (kernel: #DE panic)

Root cause and reasoning

Source-certain div-by-zero, radeon/ci twin of DF-3612 (si) / DF-3621 (amdgpu ci). radeon_atombios_get_asic_ss_info() copies ss->rate straight from the VBIOS (radeon_atombios.c:1546, usSpreadRateInKhz) with no zero check and returns true on a matching entry. ci_calculate_mclk_params() then computes clks = reference_clock * 5 / ss.rate (ci_dpm.c:2876) and ci_calculate_sclk_params() computes clk_s = reference_clock * 5 / (reference_divider * ss.rate) (ci_dpm.c:3227). Both are u32 divisions; a zero rate raises #DE in kernel context -> panic. Reachable whenever caps_mclk_ss_support/caps_sclk_ss_support are set (they are set unconditionally when the ASIC_InternalSS_Info header parses, ci_dpm.c:5953-5957) and the SS assignment table contains a matching entry with rate==0 - trivially crafted. On-guest harness section [B] proved 100*5/0 faults with SIGFPE (userland analogue of #DE). Kernel path unreachable on this GPU-less guest, so overall inconclusive.

Exploitability

Crafted VBIOS with an ASIC_InternalSS_Info assignment whose usSpreadRateInKhz is 0 and whose target-clock range covers the boot mclk/sclk -> u32 divide by zero -> kernel panic at DPM enable. DoS only. (Hardware-gated; harness proved the arithmetic fault.)

Recommended fix

Reject SS entries with rate == 0 (skip SS programming / return -EINVAL) in ci_calculate_mclk_params and ci_calculate_sclk_params. See fix.diff.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.