DF-4582 VERDICT

Finding: rs690_crtc_bandwidth_compute() divide-by-zero via dfixed_const(mode->clock) 32-bit shift wrap; local user with DRM access on RS690/RS740/RS780/RS880 hardware turns one DRM_IOCTL_MODE_SETCRTC into a kernel panic (integer divide fault, trap 18).

Status: primitive reproduced on guest (kernel + userland + shipped

binary); end-to-end ioctl chain NOT executed (no AMD IGP in the QEMU guest). Overall: inconclusive for the full chain, confidence: likely — every hop of the chain is individually proven (see below), only the hardware hop is missing.

The bug, line by line

• sys/dev/drm/radeon/rs690.c:326-329 c a.full = dfixed_const(mode->clock); /* (u32)(clock << 12) */ b.full = dfixed_const(1000); a.full = dfixed_div(a, b); /* MHz-ish; == 0 when wrapped */ pclk.full = dfixed_div(b, a); /* divisor == 0 -> #DE */
• sys/dev/drm/include/drm/drm_fixed.h:35 dfixed_const(A) = (u32)((A)<<12) — clock = 1048576 (2^20 kHz) ⇒ 2^20 << 12 = 2^32 ≡ 0 (mod 2^32).
• sys/dev/drm/include/drm/drm_fixed.h:62-70 dfixed_div → do_div(tmp, B.full) → sys/dev/drm/include/linux/math64.h:36-42 __rem = n % __base; n /= __base — __base==0 ⇒ divq by zero.

Reachability chain (each hop verified in this tree)

1. Local user opens /dev/dri/cardN ⇒ becomes DRM master (MODE_SETCRTC is DRM_MASTER|DRM_UNLOCKED, drm_ioctl.c:656).
2. drm_mode_setcrtc (drm_crtc.c:655) → drm_mode_convert_umode (drm_modes.c:1691): only clock > INT_MAX rejected (:1696); our 1048576 passes; drm_mode_validate_driver (:1145) → drm_mode_validate_basic (:1106) rejects only clock == 0 (:1114) — 1048576 passes; radeon installs no mode_config.funcs->mode_valid (radeon_display.c:1350-1353), so no range check exists. drm_crtc_check_viewport only checks fb geometry.
3. Mode applied by crtc helpers (encoder mode_fixups in radeon are unconditional return true, e.g. atombios_encoders.c:356); PLL programming is best-effort and does not fail the modeset.
4. crtc enable → radeon_pm_compute_clocks (atombios_crtc.c:296) → radeon_pm_compute_clocks_old (radeon_pm.c:1729): PROFILE method calls radeon_pm_set_clocks unconditionally (:1753-1755).
5. radeon_pm_set_clocks → radeon_bandwidth_update (radeon_pm.c:311-312, guarded only by active_crtc_count != 0 — true after the modeset).
6. rs690_bandwidth_update (rs690.c:583) → rs690_crtc_bandwidth_compute (rs690.c:625) with crtc->base.mode = the crafted mode → #DE.

ASICs: .bandwidth_update = &rs690_bandwidth_update for RS690/RS740 (radeon_asic.c:727) and RS780/RS880 (radeon_asic.c:1138).

What was executed on the guest

The harness dfixed_div is marked noinline in the KERNEL build so the compiler cannot fuse the inner (by-constant) and outer divisions — the shipped radeon.ko build happens not to fuse them either (the disassembly proves a real div by the runtime divisor); noinline reproduces exactly that codegen shape without changing any arithmetic.

Why not "reproduced" overall

The DRM ioctl → modeset → bandwidth-update chain requires an RS690/RS740/ RS780/RS880 IGP; the audit guest's only GPU is virtio-vga and /dev/dri does not exist. The panic primitive, the zero-divisor arithmetic, the missing validation, and the trigger plumbing are all individually demonstrated or source-proven; the single missing hop is the hardware. Hence status: inconclusive, reproduced: 0, impact: panic, confidence: likely (certain for the primitive).

Fix validation

fix.diff adds a zero-divisor guard after the clock conversion (bail with the same safe watermark the disabled-CRTC path uses, rs690.c:283-287). Validated at harness level: baseline kernel-flag build panics (trap 18); WITH_FIX build survives all scenarios and unloads cleanly. A full hardware validation would need an RS690-class board.

Exploitability ceiling

DoS (kernel panic) — no memory corruption; the write set of the bug is the divide fault only. On multi-user RS780-era machines (780G/785G chipsets were mass-market) with /dev/dri group access this is a one-syscall local kernel panic from any unprivileged user who can open the card.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.