Latent divide-by-zero family in calculate_ss: unvalidated ATOMBIOS spread-spectrum percentage_divider and modulation rate (runtime-dead today: ENABLE_SS hardcoded 0)
Summary
calculate_ss divides by three unvalidated ATOMBIOS values: percentage_divider (0 for V2.1-parsed entries - the parser memsets and never sets it), modulation_freq_hz (0 whenever the VBIOS rate field is 0 in ANY parser version), and the modulation_time product. All funnel into the u64 % whose ASSERT is WARN_ON-only - a zero denominator executes #DE. Currently unreachable: enable_spread_spectrum runs only under ENABLE_SS which its only two producers hardcode to 0. Validate-in-getter fix so the family's rate==0 history (DF-4167) does not recur the day ENABLE_SS is wired.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4380 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 161 B | ↓ raw | |
| verdict.json | file | 1.1 KB | view raw |
DF-4380 — calculate_ss latent div0 family (ENABLE_SS hardcoded 0)
Info hardening; no pack per contract. Validate divider/rate in get_ss_info_from_atombios.
Fix verification
not_testableskip entries with spread_percentage_divider == 0 || spread_spectrum_range == 0 in get_ss_info_from_atombios (treat like the HDMI percentage>6 rejection); optionally guard calculate_ss entry
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; path:line citations in pass-2 result block
Verdict
source-verified; latent (trigger flag hardcoded 0)
No comments yet.