DF-4127 — Divide-by-zero in rv6xx_calculate_spread_spectrum_clk_v: second division's truncating divisor (and zero ref_freq first division)

• File: sys/dev/drm/radeon/rv6xx_dpm.c
• Lines: 534-542 Severity: Low Confidence: likely
• Status: reproduced (impact: dos) — hardware-gated crafted-VBIOS/firmware threat model; harness-reproduced on the DragonFly guest.

Summary

rv6xx_calculate_spread_spectrum_clk_v (rv6xx_dpm.c:534-542): u32 fb_divider = vco_freq / ref_freq; :538 return (ss_percent * ss_rate * 4 * fb_divider^2 / (5375 * ((vco_freq * 10) / (4096 >> fb_divider_scale)))); :540-541 - :541 divides by 5375 * inner where inner = (vco_freq*10)/(4096>>scale) TRUNCATES: for a small VCO (fb_divider_scale=1 on RV670+ -> threshold 2048; VCO < 204.8 in 10 kHz units) inner == 0, making the whole divisor 0 -> u32 divide-by-zero (#DE -> kernel panic). VCO derives from rdev->clock.mpll.reference_freq and power-table MCLKs via the ATOM divider computation — all crafted-VBIOS controlled (a small reference_freq in the firmware info table trivially yields small VCO). Nonzero ss.rate/percent used — this is NOT the DF-1392 zero-SCLK/zero-ss.rate condition. - :538 divides by ref_freq which is ref_clk/(dividers.ref_div+1) passed from :568/:686 — ref_clk==0 (zero reference_freq in the VBIOS firmware table) traps the same way. rv6xx instance of the DF-4120 cypress 'second-division truncation div0' family (last member). Reached via rv6xx_program_mclk_spread_spectrum_parameters (mclk_ss is live; sclk_ss is force-disabled at :1987).

Reproduce (harness)

./build.sh && ./run.sh — exit 77 = OOB/div0 confirmed by verbatim kernel code; -p run = proposed fix, exit 0.

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

DF-4127 verdict — Divide-by-zero in rv6xx_calculate_spread_spectrum_clk_v: second division's truncating divisor (and zero ref_freq first division)

Reproduced? — reproduced (dos)

Harness-reproduced on the DragonFly guest: the VERBATIM function (volatile inputs to defeat constant folding) traps with SIGFPE — case A: nonzero ref_freq=10000, ss.rate=30, ss.percent=2, VCO=200 -> inner (200*10)/2048 = 0 -> divisor 0 (the DF-4120-twin second-division condition); case B: ref_freq=0 -> traps at :538. Both exit 77, stable across 3 runs; the -p guarded variant returns 0 for both (fix_run.log). Kernel analog: u32 division by zero in radeon_pm context -> #DE -> panic. Hardware-gated on real RV6xx (MCLK SS path).

Root cause (path:line)

rv6xx_calculate_spread_spectrum_clk_v (rv6xx_dpm.c:534-542): u32 fb_divider = vco_freq / ref_freq; :538 return (ss_percent * ss_rate * 4 * fb_divider^2 / (5375 * ((vco_freq * 10) / (4096 >> fb_divider_scale)))); :540-541 - :541 divides by 5375 * inner where inner = (vco_freq*10)/(4096>>scale) TRUNCATES: for a small VCO (fb_divider_scale=1 on RV670+ -> threshold 2048; VCO < 204.8 in 10 kHz units) inner == 0, making the whole divisor 0 -> u32 divide-by-zero (#DE -> kernel panic). VCO derives from rdev->clock.mpll.reference_freq and power-table MCLKs via the ATOM divider computation — all crafted-VBIOS controlled (a small reference_freq in the firmware info table trivially yields small VCO). Nonzero ss.rate/percent used — this is NOT the DF-1392 zero-SCLK/zero-ss.rate condition. - :538 divides by ref_freq which is ref_clk/(dividers.ref_div+1) passed from :568/:686 — ref_clk==0 (zero reference_freq in the VBIOS firmware table) traps the same way. rv6xx instance of the DF-4120 cypress 'second-division truncation div0' family (last member). Reached via rv6xx_program_mclk_spread_spectrum_parameters (mclk_ss is live; sclk_ss is force-disabled at :1987).

Chain

crafted VBIOS (small mpll reference_freq / small VCO from power-table MCLKs) -> rv6xx_program_mclk_spread_spectrum_parameters:685 -> rv6xx_calculate_spread_spectrum_clk_v:541 (or :538) -> divide by zero -> kernel panic

Kernel refs

• sys/dev/drm/radeon/rv6xx_dpm.c:534
• sys/dev/drm/radeon/rv6xx_dpm.c:538
• sys/dev/drm/radeon/rv6xx_dpm.c:541
• sys/dev/drm/radeon/rv6xx_dpm.c:685
• sys/dev/drm/radeon/rv6xx_dpm.c:663

Fix

Fail-safe 0 (SS disabled) for both degenerate divisors — identical shape to the DF-4120 cypress fix. Harness -p variant validated both cases.

fix.diff applies cleanly against the read-only sys/ tree (2-file for DF-4125; note the radeon_pm.c hunk also needs dpm_failed_unlock: mutex_unlock(&rdev->pm.mutex); added to the existing dpm_failed label path — spelled out here since the label does not exist in the unfixed tree). Kernel-level fix validation is not possible on this guest (no i915/RV6xx devices; the drivers never attach in QEMU); harness-level fix validation IS included: the -p runs exercise the patched parse logic against the identical crafted input and exit 0 (fix_run.log).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.