DF-4091 — dce110_timing_generator_validate_timing underflow lets inconsistent timings pass; program_blanking programs wrapped blanking values

File: sys/dev/drm/amd/display/dc/dce110/dce110_timing_generator.c (validate :1109-1163; sink program_blanking:596-697) Class: CWE-191 integer underflow in the display timing gatekeeper (checklist item (d): bounds rejects) Severity: Low — pass 2 (GLM 5.3), bucket base:dev Confidence: certain (arithmetic); hardware-gated impact

The bug

dce110_timing_generator_validate_timing() is the CRTC-level gatekeeper — called for every stream via dc_validate_stream() (core/dc_resource.c:2873). Two of its computations wrap on u32:

h_blank = h_total - h_addressable - h_border_right - h_border_left;  /* :1144 */
if (h_blank < tg110->min_h_blank) return false;                      /* passes if wrapped */
...
h_back_porch = h_blank - (h_front_porch - h_sync_width);             /* :1154-1157, wraps */

• If h_total < h_addressable + borders, h_blank underflows to ~4 G and sails through the < 56 check.
• If h_sync_width > h_front_porch, h_back_porch underflows and passes < 4.
• There are no vertical checks at all (no v_addressable fit, no v-porch minimums).

The accepted timing is later programmed by dce110_timing_generator_program_blanking() / program_timing_generator():

tmp = timing->h_total - (h_sync_start + timing->h_border_left);  /* :656-657 */
...
tmp = timing->v_total - (v_sync_start + timing->v_border_top);    /* :679 */

both of which wrap the same way; set_reg_field_value_ex() (dm_services.h:133-141) masks the wrapped value into the field, so the CRTC receives garbage (truncated-to-13/16-bit) H/V blank start/end values.

Impact ceiling (honest)

• Not kernel memory corruption: every value is field-masked into fixed MMIO registers computed from constant register offsets (CRTC_REG/DCP_REG); no pointer or length is derived from timing data anywhere in this file (no division exists either — the DF-3828 watermark div0 class is absent here).
• Worst realistic effect: an inconsistent CRTC timing (blanking window that does not exist inside the total) is programmed — display corruption, loss of sync, or a wedged display pipe; a hang would be a system-level DoS (speculative — no ASIC available to test).
• Userspace normally cannot smuggle such a mode past DRM-core mode validation (hdisplay ≤ htotal etc.), but dc_validate_stream exists as defense-in-depth and is bypassable by any internal producer that adjusts timings (e.g. DRR/FreeSync v_total adjustments in set_drr:366-468, which itself only masks values).

Hardware-gated: the audit guest has no AMD ASIC (env.txt), so no runtime verification was possible; source-level certainty only, matching the dce110 family checklist instruction.

Fix

fix.diff — reject timings whose active+borders do not fit inside the totals (h and v), reject zero addressable, and guard the back-porch computation against its underflow before it happens. Compile-validated: the whole amdgpu.ko module (which compiles this file) rebuilt with -Werror after applying the diff (BUILD_EXIT=0, fix_build.log).

DF-4091 VERDICT

Status: untested — hardware-gated (no AMD ASIC on the audit guest; vgapci0 ... chip=0x11111234 is QEMU std VGA, env.txt). Source-level certainty, per the dce110-family checklist instruction. Confidence: certain (arithmetic defects); impact ceiling speculative (no hardware to observe a misprogrammed CRTC).

What was checked (whole file, 2261 lines)

• (a) program_timing / program_blanking arithmetic (:281-353, :596-697): all h/v sync-start and blank-start/end computations can wrap (u32) on inconsistent timings, but every sink is set_reg_field_value_ex (dm_services.h:133-141) which masks to the register field width before dm_write_reg to a constant address (CRTC_REG/DCP_REG + fixed offsets). No kernel-memory effect is reachable from timing values. No division exists in the file (DF-3828 watermark-div0 class absent).
• (b) set_drr / vtotal bounds (:366-468): vertical_total_max/min zero-checked (:387-389); -1 values masked into fields. Benign.
• (c) test pattern generators (:699-1102): fixed arrays src_color[6]/dst_color[6], loops bounded by 6; shifts src_bpc - dst_bpc ∈ {6,8,10}, 16 - dst_bpc ∈ {6,8,10}; no UB.
• (d) validate_timing (:1109-1163): the finding — h_blank (:1144-1146) and h_back_porch (:1154-1157) underflow past their minimum checks; zero vertical checks. Gatekeeper called at core/dc_resource.c:2873 (dc_validate_stream).
• (e) DCCG/clock source: not touched by this file (no clock-source interaction code present) — n/a.
• (f) globalsync / crc (:1214-1382, :2094-2197): check_point - FLIP_READY_BACK_LOOKUP (:1300) can underflow only if the CRTC V_TOTAL register reads < 3 (hardware state, not user timing) — masked anyway. CRC window values are pure masked field writes (:2116-2157). disable_vga (:1797-1836) leaves addr = 0 on an unknown controller_id, but dce110_timing_generator_construct:2245 derives the id as CONTROLLER_ID_D0 + instance with instance bounded by the resource pool (≤ 6 pipes) — default case unreachable in practice.

Verification performed

• No amdgpu device in the guest ⇒ no runtime run; the module builds and the file's logic is fully source-traceable (all sinks masked register writes).
• fix.diff applied to the guest /usr/src; the complete amdgpu module (which compiles dce110_timing_generator.c) rebuilt with -Werror and linked amdgpu.ko (BUILD_EXIT=0; fix_build.log — full untrimmed build log). /usr/src restored pristine afterwards; guest reset with the clean-source snapshot.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.