DF-3828 — amdgpu DCE11: divide-by-zero family in the display watermark math (dce_v11_0_latency_watermark + callers)

What

sys/dev/drm/amd/amdgpu/dce_v11_0.c, dce_v11_0_latency_watermark() (lines 903-951) — the DF-3665 (evergreen latency_watermark) family twin:

907 u32 available_bandwidth = dce_v11_0_available_bandwidth(wm);
908 u32 worst_chunk_return_time = (512 * 8 * 1000) / available_bandwidth;   /* DIV0 */
909 u32 cursor_line_pair_return_time = (128 * 4 * 1000) / available_bandwidth; /* DIV0 */
910 u32 dc_latency = 40000000 / wm->disp_clk;                               /* DIV0 */
...
918 if (wm->num_heads == 0)     /* guard placed AFTER the divides */
919     return 0;

All three divides execute before the only guard in the function, and none of the three divisors is validated anywhere on the path.

Zero-input sources (traced)

dce_v11_0_program_watermarks() (1039-1161) fills the struct:

• 1058-1066: !adev->pm.dpm_enabled → wm.yclk = adev->pm.current_mclk * 10, wm.sclk = adev->pm.current_sclk * 10. pm.current_sclk/current_mclk are seeded from amdgpu_atombios_get_clock_info() (sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:718-719) straight from the VBIOS ulDefaultEngineClock/ulDefaultMemoryClock (:677-680) without any zero-guard — note every neighbouring clock field in that parser does get a guard (:610, :642, :669, :694, :708), these two do not, and the assignment at :718 even runs when the firmware-info parse fails with ret != 0, leaving both clocks 0.
• With yclk == 0 (or sclk == 0), dce_v11_0_available_bandwidth() (851-859) = min(dram, data_return, dmif) = 0 → line 908/909 divide by zero.
• 1068: wm.disp_clk = mode->clock — a zero pixel clock reaches line 910 (secondary vector; the primary realistic one is the zero sclk/mclk).

Trigger (local user → kernel panic)

dce_v11_0_crtc_do_set_base() → dce_v11_0_bandwidth_update() (dce_v11_0.c:2106) → dce_v11_0_program_watermarks() (1186) → dce_v11_0_latency_watermark() (1085 / 1124). A mode-set ioctl from any DRM client (user with /dev/dri/card0 access — console/X users) on a system where the clocks read as zero (VBIOS default-clock fields zero + DPM off) takes #DE in kernel context → panic. Sibling divides by wm->num_heads at 967/987 are safe only because the caller's guard at 1050 requires num_heads != 0; dce_v11_0_check_latency_hiding() divides wm->lb_size / wm->src_width (1004) — same family, requires a zero-width mode.

Impact

Kernel divide-by-zero (#DE) → immediate panic of a machine with an AMD Carrizo/Stoney/Polaris/VEGAM GPU (DCE11/11.2): local denial of service by an unprivileged user with graphics-device access. Hardware-gated (AMD ASIC required). Severity Medium (local DoS, unusual-config clock-zero precondition).

Reproduce (arithmetic-level replica — no AMD GPU required)

scp wm_div0.c dfbsd-maxx:/tmp/
ssh dfbsd 'cc -O2 -Wall -o /tmp/wm_div0 /tmp/wm_div0.c'
ssh dfbsd '/tmp/wm_div0; echo exit=$?'

Expected (see run.log, run.2.log):

healthy clocks: watermark math returns 2297 (no trap)
affected clocks (current_mclk=0, current_sclk=0): entering latency_watermark()...
Floating point exception (core dumped)
exit=136        <- SIGFPE = #DE, the exact kernel fault class

The replica copies the arithmetic of dce_v11_0_dram_bandwidth/data_return_bandwidth/dmif_request_bandwidth → available_bandwidth → the three divides at :908-:910 with inputs taken from argv (so the compiler cannot fold the trap away). Userspace #DE = SIGFPE; in kernel mode the identical div instruction is an unrecoverable

DE → panic.

Kernel-path verification status

The audit guest has no AMD display ASIC (pciconf -l: bochs VGA 1234:1111 only; no /dev/dri, no drm/amdgpu modules — env.txt), so dce_v11_0_* never executes in-kernel there: verdict not_reproduced for the kernel reachability; the divide-by-zero primitive itself is proven on-guest (SIGFPE, 2 runs) and certain at source level.

Fix

fix.diff — validate available_bandwidth and wm->disp_clk before dividing (and move the num_heads check first), plus harden the mode->clock divides at 1051/1053 and add the missing zero-guards for default_sclk/default_mclk in the VBIOS clock parser.

DF-3828 VERDICT

Bottom line

**Source-certain divide-by-zero family in the DCE11 watermark math; arithmetic-level reproduction on the guest succeeded (SIGFPE = the exact

DE fault class, 2/2 runs); kernel-path reproduction impossible here (no

AMD ASIC). Verdict not_reproduced for the kernel reach with the primitive proven and the trigger chain fully traced.**

The defect

dce_v11_0_latency_watermark() — sys/dev/drm/amd/amdgpu/dce_v11_0.c:

• :908 (512 * 8 * 1000) / available_bandwidth — divides by dce_v11_0_available_bandwidth(wm) (:851-859) = min(dram_bw, data_return_bw, dmif_bw); each term is a fixed-point product that truncates to 0 when its clock input is 0.
• :909 (128 * 4 * 1000) / available_bandwidth — same divisor.
• :910 40000000 / wm->disp_clk — wm->disp_clk = mode->clock (program_watermarks :1068).
• :918 if (wm->num_heads == 0) return 0; — the only guard, placed after the divides (mirrors the DF-3665 evergreen pattern).

No caller validates the divisors: dce_v11_0_program_watermarks (:1085, :1124) guards only enabled && num_heads && mode (:1050).

Zero-clock provenance (kernel refs)

• dce_v11_0_program_watermarks:1064-1065 (DPM-disabled path): wm.yclk = adev->pm.current_mclk * 10; wm.sclk = adev->pm.current_sclk * 10.
• amdgpu_atombios_get_clock_info — sys/dev/drm/amd/amdgpu/amdgpu_atombios.c: default_sclk/default_mclk taken verbatim from the VBIOS firmware-info table at :677-680 without the zero-guard that every neighboring clock field gets (:610, :642, :669, :694, :708), and unconditionally assigned to pm.current_sclk/current_mclk at :718-719 even when the table parse failed (ret != 0), leaving both 0.
• Consequence: on a board whose VBIOS reports zero default engine/memory clocks (or after a failed clock-info parse) with power management disabled, the very first watermark computation divides by zero.

Trigger chain (unprivileged local user)

drm_mode_setcrtc (any DRM client with /dev/dri/card0, e.g. an X/wayland user; no DRM-Master privilege needed beyond the fd) → dce_v11_0_crtc_do_set_base → dce_v11_0_bandwidth_update (dce_v11_0.c:2106) → dce_v11_0_program_watermarks (:1186) → dce_v11_0_latency_watermark (:1085/:1124) → div by 0 → #DE → panic. Also reached from dce_v11_0_crtc_dpms → amdgpu_pm_compute_clocks bandwidth updates on DPMS transitions.

What was run on the guest

wm_div0.c (argv-parameterized, so clang cannot fold the trap — the first version did fold it into ud2/SIGILL, which is itself proof the divide is reachable, but the shipped version traps the honest way):

• run.log, run.2.log: healthy-clock control returns 2297; zero-clock input → Floating point exception (core dumped), exit 136 (signal 8 = SIGFPE = #DE), confirmed by dmesg: pid ... (wm_div0) ... exited on signal 8.
• env.txt: guest PCI bus = i440FX + bochs VGA (1234:1111) + virtio; no AMD display controller; no /dev/dri; no drm/amdgpu kld → the kernel path cannot attach on this guest.

Classification per honest-status table

Guest reachable + target device absent → not_reproduced, reproduced=0, impact=none (nothing kernel-level observed). Realistic impact ceiling on equipped hardware: local DoS via kernel panic (Medium). Confidence: certain (source trace + on-guest arithmetic proof of the fault class).

Negative results (classes hunted and killed in this file)

• IV-ring OOB in dce_v11_0_crtc_irq (:3332-3333, no bounds check on crtc = entry->src_id - 1) and dce_v11_0_pageflip_irq (:3239-3242, array load before the bounds check): killed — amdgpu_irq_dispatch (amdgpu_irq.c:414-432) only invokes handlers for registered (client_id, src_id) pairs and validates src_id < AMDGPU_MAX_IRQ_SRC_ID; crtc_irq is registered only for src_id ∈ {1..num_crtc} (:2870) and pageflip_irq for src_id ∈ {8..18} (:2875), so the handler-side indices stay within crtcs[6] (AMDGPU_MAX_CRTCS=6, amdgpu_mode.h:65). Hardening nit only.
• Audio pin arrays: audio.pin[AMDGPU_MAX_AFMT_BLOCKS=9] (amdgpu_mode.h:261) vs num_pins ≤ 8 and pin_offsets[8] (:1426-1436) — in-bounds; afmt dig->dig_encoder ≤ 6 < afmt[9] — in-bounds; dce_v11_0_audio_enable NULL-checks the pin (:1419).
• dce_v11_0_is_display_hung crtc_status[6] vs num_crtc ≤ 6 — in-bounds; vga_control_regs[6] indexed by crtc_id ≤ 5 — in-bounds.
• num_heads divides at :967/:987 — protected by caller guard :1050.
• Suspend/resume: dce_v11_0_suspend/resume (:3003-3032) are plain hw_fini/hw_init wrappers with saved backlight; no lifetime issue found.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.