DF-4373 — Divide-by-zero (#DE panic) in dce_transform_get_max_num_of_supported_lines

What

sys/dev/drm/amd/display/dc/dce/dce_transform.c:710 divides max_pixels_supports / pixel_width guarded only by ASSERT(pixel_width) (:675), and ASSERT in this tree compiles to WARN_ON only (sys/dev/drm/amd/display/dc/os_types.h:48 — #define ASSERT(expr) WARN_ON(!(expr))). Execution continues into the integer division; pixel_width == 0 produces a divide-error fault in kernel mode → kernel panic (local DoS).

Who can trigger

Any DRM master holder — on a desktop/seat system that is the ordinary unprivileged session user (logind gives the session DRM master). A DRM_MODE_ATOMIC_TEST_ONLY commit suffices: the division happens on the atomic-check path (dc_validate_global → resource_build_scaling).

Concrete trigger (real DCE100/110/112/120 hardware)

1. CRTC: any mode, e.g. 640x480.
2. Plane: source ≥ 16x16 (e.g. 640x480 dumb buffer), CRTC_X = 640 (== mode width: flush off the right edge), CRTC_Y = 0, CRTC_W = 1, CRTC_H = 480.
3. Submit atomic commit (TEST_ONLY is enough).

Why this is accepted by every check: - fill_rects_from_plane_state (amdgpu_dm.c:2210-2238) never clips to the CRTC and only rejects zero-sized rects; clip_rect = dst_rect. - dc_validate_plane (dc_resource.c:2891-2897) validates pixel format only. - calculate_viewport (dc_resource.c:543): viewport.width = clip.width * surf_src.width / dst_rect.width = 1 * 640 / 1 = 640 — viewport is in SOURCE pixels, so the viewport.width < 16 guard (dc_resource.c:1122) PASSES even though the visible recout is empty. - calculate_recout (dc_resource.c:631-643): recout.x = 640; clamp at :639-643 gives recout.width = (0 + 640) - 640 = 0 exactly. - dce_transform_get_optimal_number_of_taps (dce_transform.c:896-907): prescaler_on is hard-coded true at construction (:1359); viewport.width (640) > recout.width (0) → pixel_width = recout.width = 0. - dce_transform_get_max_num_of_supported_lines (:667-711): ASSERT no-ops → division by zero at :710.

An underscan variant also works (connector "underscan hborder" property, range 0..128 — amdgpu_display.c:605-607, stream dst inset at amdgpu_dm.c:2502-2506): a 1px-wide plane fully inside the CRTC with hborder 128 on a 640-wide mode gives recout.width = 1*512/640 = 0 at dc_resource.c:637-638.

Build / Run (probe)

• ./build.sh && ./run.sh — compiles the probe and attempts to open /dev/dri/card0. On machines without an AMD DC GPU it reports the device absence (this is what happens on the audit QEMU guest, which has only QEMU std VGA, vendor 0x1234).

Expected on real hardware

Immediate kernel panic: Fatal trap 12: divide error fault... (actually trap 0

DE) in dce_transform_get_max_num_of_supported_lines, during

amdgpu_dm_atomic_check.

Files

• trigger_df4373.c — standalone probe / ioctl sketch
• VERDICT.md — full static proof chain and honest reproduction status
• fix.diff — one-guard fix (returns 0 = "no lines supported" so validation fails cleanly)

DF-4373 VERDICT — divide-by-zero in dce_transform.c:710

Status: not_reproduced — target hardware absent (no AMD GPU in QEMU guest). The exploit chain is proven statically, link by link, from UABI to the faulting instruction.

Reproduction attempt (honest)

• Guest: DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026, QEMU std VGA only (vgapci0@pci0:0:2:0 class=0x030000 chip=0x11111234).
• /dev/dri does not exist; pciconf -l shows no vendor 0x1002 device; the amdgpu DC path (dce_transform.c is compiled into the amdgpu module, sys/dev/drm/amd/amdgpu/Makefile:12-13) cannot attach.
• Probe built cleanly (cc -O2) and run: exit 2, "cannot open /dev/dri/card0". See build.log / run.log.
• Therefore the division could not be executed. Per the audit's status mapping, device-absent on the guest = not_reproduced with impact none observed on this guest; the analysis below is the deliverable.

Why the bug is real (static proof chain, every step cited)

1. Unprivileged reachability. Modeset ioctls require DRM master; on any modern seat/desktop the session user holds DRM master (root not required otherwise). The faulting path runs during atomic check (DRM_MODE_ATOMIC_TEST_ONLY suffices): amdgpu_dm_atomic_check → dc_validate_global → resource_build_scaling (dc_resource.c:1119-1147) → transform_get_optimal_number_of_taps → dce_transform_get_max_num_of_supported_lines → division at :710.

2. Plane rects are never clipped by amdgpu_dm. fill_rects_from_plane_state (amdgpu_dm.c:2210-2238) copies raw crtc_x/y/w/h, rejects only zero dimensions, and sets clip_rect = dst_rect (:2238). amdgpu_dm never calls drm_atomic_helper_check_plane_state (verified: dm_plane_atomic_check at amdgpu_dm.c:3585-3603 only calls fill_rects + dc_validate_plane).

3. Validation is format-only. dc_validate_plane (dc_resource.c:2891): "TODO For now validates pixel format only" → returns DC_OK.

4. The ≥16 guard tests the wrong rectangle. calculate_viewport (dc_resource.c:543) computes viewport.width = clip.width * surf_src.width / plane dst_rect.width — SOURCE pixels. A plane with src 640 wide, dst 1 wide, positioned flush off the right edge keeps viewport.width = 640, so viewport.width < 16 (dc_resource.c:1122) does NOT trip.

5. recout clamps to exactly zero. calculate_recout (dc_resource.c:631-643): with stream dst = [0,640) and raw plane clip.x = 640: recout.x = 0 + (640-0)*640/640 = 640; clamp at :639-643: recout.width = (0+640) - 640 = 0. (struct rect fields are signed ints, dc_hw_types.h:107-112; the zero is exact, not an underflow.)

6. prescaler_on forces recout to be used. dce_transform.c:1359 sets prescaler_on = true unconditionally in dce_transform_construct (used by DCE100/110/112/120 resource pools — dce100_resource.c:523-533, dce110_resource.c:539-549, dce112_resource.c:538-548, dce120_resource.c:743-753). dce_transform.c:900-902: viewport.width(640) > recout.width(0) → pixel_width = 0.

7. ASSERT does not stop execution. os_types.h:48: #define ASSERT(expr) WARN_ON(!(expr)) — :675 warns and falls through to return (max_pixels_supports / pixel_width) at :710 → integer #DE in kernel mode → trap → kernel panic.

Alternative zero source (no off-CRTC positioning): underscan. The connector property "underscan hborder" (range 0..128, amdgpu_display.c:605-607) insets stream->dst (amdgpu_dm.c:2502-2506) while stream->src stays the full mode; a fully-visible 1px-wide plane then yields recout.width = clip.width * dst.width / src.width = 1*512/640 = 0 at dc_resource.c:637-638.

Impact

Local DoS (kernel panic) by an unprivileged session user on any DragonFly machine with a DCE100/110/112/120-era AMD GPU driven by the in-tree amdgpu DC code. Same class as DF-3828/DF-3857/DF-3869 (DCE watermark divide families).

Fix validation

Not possible on this guest (no AMD GPU; kernel build with the fix cannot be exercised on DCE hardware). fix.diff is authored against the read-only tree and returns 0 lines-supported for degenerate input, which makes dce_transform_get_optimal_number_of_taps return false (:910-911 with max_num_of_lines==0), failing validation cleanly instead of dividing. fix_status: not_testable (hardware absent).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.