DF-3858 — vega20_get_sclk_od/get_mclk_od: count-1 underflow wild read + divide-by-zero on zero golden clock (DF-3686/DF-3707 twins)

What

sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:1318-1381:

int value        = sclk_table->dpm_levels[sclk_table->count - 1].value;        /* :1326 */
int golden_value = golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value; /* :1327-28 */
value -= golden_value;
value = DIV_ROUND_UP(value * 100, golden_value);                               /* :1332  <-- #DE */

(twin at :1372-1378 for memclk.)

Case A — divide-by-zero (DF-3707 twin). When the DPM_GFXCLK (resp. DPM_UCLK) SMU feature is not enabled, vega20_setup_gfxclk_dpm_table() takes the boot-clock branch (:544-547): count = 1; dpm_levels[0].value = data->vbios_boot_state.gfx_clock / 100; — the raw VBIOS bootup_sclk_in10khz copied with no zero check (ppatomfwctrl.c:523/:556 → vega20_hwmgr.c:745). A crafted/blank VBIOS value 0 ⇒ golden_value == 0 ⇒ DIV_ROUND_UP(x, 0) ⇒ #DE panic.

Case B — unsigned count-1 underflow (DF-3686 twin). If DPM (re-)enable aborts inside vega20_setup_default_dpm_tables() (any SMU message failure, PP_ASSERT at :594/:613/... returns early after the memset of the whole dpm_table at :588), dpm_table/golden_dpm_table stay all-zero (count == 0). Boot-time failure tears the device down (hwmgr_hw_init → err2 frees the backend, probe fails) — but the resume path has no cleanup (hwmgr_resume, hwmgr.c:308-330: returns the error with the backend intact and pm_en untouched), and pm_en was set at powerplay-create time (amd_powerplay.c:51), so after a failed SMU re-enable on resume the world-readable sysfs node still dispatches into get_sclk_od ⇒ dpm_levels[(uint32_t)0 - 1] = dpm_levels[0xFFFFFFFF] ⇒ read at +34,359,738,360 bytes (~32 GiB) past dpm_levels[0] inside the kzalloc'd struct vega20_hwmgr backend — a wild kernel OOB read; if it lands on a zero, case A's divide then panics.

Reach (world-readable)

/sys/class/drm/card0/device/pp_sclk_od and pp_mclk_od are S_IRUGO (amdgpu_pm.c:1019-1022) → amdgpu_get_pp_sclk_od (:794, no other check) → pp_dpm_get_sclk_od (amd_powerplay.c:757, only !hwmgr || !pm_en guard) → vega20_get_sclk_od. Any local user can cat it.

Reproduce (arithmetic-level; kernel reach hardware-gated)

build.sh    # cc -O2 -Wall -o /tmp/od_div0 /tmp/od_div0.c
run.sh      # /tmp/od_div0 0   (case A)   /tmp/od_div0 1   (case B)

Expected (observed on the audit guest, run.log):

case A: ... DIV_ROUND_UP(x, 0)
Floating point exception (core dumped)        # exit=136 (SIGFPE = #DE), 3/3 runs
case B: golden gfx_table.count = 0 -> index (uint32_t)0-1 = 4294967295
        effective read offset = 34359738360 bytes past dpm_levels[0] (elem size 8)

Disassembly on the guest confirmed the case-B load mov 0x401ef8(,%rax,8),%ecx with rax = 0xFFFFFFFF really executes (+34 GB address); in this userland process it happened to land on an unrelated mapped page (returned garbage 0) — in the kernel the backend is a kmalloc object and a +34 GB landing is near-certainly unmapped (page-fault panic) or feeds garbage into the case-A divide.

Impact

Local DoS (panic) and/or wild OOB read via an unprivileged sysfs read, on a Vega20 (Radeon VII / MI50 / MI60) in the affected states (crafted VBIOS zero boot clock; or DPM bring-up failure). Hardware/VBIOS-gated.

DF-3858 VERDICT — vega20_get_sclk_od/get_mclk_od count-1 underflow + div0

Status: not_reproduced (kernel reach hardware-gated) — both arithmetic facts proven on the guest (SIGFPE 3/3; wild +34 GiB index proven in disassembly), source chain traced end-to-end.

Root cause (path:line, sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c

unless noted)

vega20_get_sclk_od() :1318-1335 (mem twin :1364-1381):

• :1326 sclk_table->dpm_levels[sclk_table->count - 1].value
• :1327-1328 golden_sclk_table->dpm_levels[golden_sclk_table->count - 1].value
• :1332 value = DIV_ROUND_UP(value * 100, golden_value);

No zero-count and no zero-divisor guard.

Case A — golden_value == 0 (DF-3707 twin)

1. vega20_setup_gfxclk_dpm_table() :538-547: when data->smu_features[GNLD_DPM_GFXCLK].enabled is false, dpm_table->count = 1; dpm_table->dpm_levels[0].value = data->vbios_boot_state.gfx_clock / 100; (:545-546).
2. data->vbios_boot_state.gfx_clock = boot_up_values.ulGfxClk (vega20_hwmgr.c:745), where ulGfxClk = fw_info->bootup_sclk_in10khz (ppatomfwctrl.c:523 and :556) — raw VBIOS u32, no zero check anywhere on this path.
3. vega20_setup_default_dpm_tables() :713-715 memcpy's the whole table into golden_dpm_table, so the golden top (and only) value is 0.
4. First cat pp_sclk_od after boot ⇒ DIV_ROUND_UP(0*100, 0) ⇒ #DE ⇒ panic. (Values in the enabled path are protected: vega20_get_dpm_frequency_by_index() :499-501 asserts *clk != 0 — the developer bounded the SMU path but not the VBIOS boot-clock path.)

Case B — count == 0 wild read (DF-3686 twin)

1. vega20_setup_default_dpm_tables() :588 memset(&data->dpm_table, 0, sizeof(data->dpm_table)); each sub-table is filled only if its SMU feature is enabled and every SMU message succeeds (:592-711, PP_ASSERT at :594/:541/:562/... return early).
2. Boot-time failure is torn down: hwmgr_hw_init (hwmgr.c:246-256) goes err2 → backend_fini (kfree backend) → pp_hw_init (amd_powerplay.c:118-130) returns the error → the powerplay IP block init fails → the device never probes (no sysfs). The live degraded state is resume: hwmgr_resume (hwmgr.c:308-330) calls phm_enable_dynamic_state_management with no cleanup on failure (no backend free, pm_en untouched), leaving the driver attached with the memset-zero dpm tables whenever SMU re-enable fails after suspend (flaky SMU / VF passthrough states).
3. hwmgr->pm_en was set at powerplay-create time (amd_powerplay.c:51) and is not cleared on the resume failure; the sysfs nodes exist for the lifetime of the device (amdgpu_device.c:2664, amdgpu_pm.c:1019-1022) and pp_dpm_get_sclk_od (amd_powerplay.c:757-763) checks only !hwmgr || !pm_en — so a world-readable cat pp_sclk_od still dispatches into vega20_get_sclk_od.
4. golden_dpm_table.count == 0 ⇒ count - 1 == 0xFFFFFFFF (uint32 count, vega20_hwmgr.h:156-159) ⇒ dpm_levels[0xFFFFFFFF].value: element size 8 ⇒ effective read offset 34,359,738,360 bytes past dpm_levels[0] in the kzalloc'd struct vega20_hwmgr backend (vega20_hwmgr_backend_init() :383).
5. Wild read outcome: unmapped ⇒ page-fault panic; mapped garbage ⇒ value - garbage then divided by garbage — and if the garbage golden value is 0, case A's #DE. (DF-1253 covers the analogous underflow inside vega20_apply_clocks_adjust_rules() :3095-3104 with the mclk_latency_table.count loop; this finding is the distinct get_sclk_od/get_mclk_od sink, checklist item (c) "OD table getters, get_max_sclk/mclk consumers".)

Why vega20_get_profiling_clk_mask/force_clock_level are NOT affected

:2229-2231 (count - 1 into a mask) and :2249/:2276 (soft_max_level >= count reject) were traced: even with count==0 the mask path shifts by 0xFFFFFFFF (x86 shl masks to 31) ⇒ soft_max_level = 31 ≥ count ⇒ -EINVAL. No OOB.

What ran on the Guest

od_div0.c replicates the exact struct layout (vega20_hwmgr.h:140-171) and the verbatim get_sclk_od body.

• Case A (count=1, value=0): SIGFPE, exit=136, 3/3 runs (run.log ×2, run.2.log), dmesg pid NNNN (od_div0), uid 0: exited on signal 8.
• Case B (count=0): prints index 4294967295 and effective offset 34359738360 bytes; the verbatim access executed (objdump on the guest: mov 0x401ef8(,%rax,8),%ecx with rax=0xFFFFFFFF) and landed on an unrelated mapped page in this userland process (returned 0) — in-kernel the same address relative to a kmalloc'd backend is a wild read.

Why not reproduced

Audit guest has 0 AMD PCI devices, no /dev/dri (env.txt); vega20_hwmgr code cannot execute. Kernel reach needs a Vega20 board in state A (crafted VBIOS zero boot clock with GFXCLK DPM feature disabled) or state B (failed DPM bring-up). Impact ceiling: unprivileged local DoS via panic + wild OOB read.

Fix validation

fix.diff makes vega20_get_sclk_od/get_mclk_od return 0 when either table count is 0 or the golden top value is 0 (mirroring the DF-3707 fix), and zero-guards the VBIOS boot-up clocks in vega20_init_smc_table (floor to existing smu_features-independent 10 kHz minimum like other consumers). git-apply-clean against the read-only sys/ tree; a patched kernel cannot be exercised on this guest (no Vega20 ASIC), so fix validation is not_testable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.