DragonFlyBSD Kernel Audit
DF-2432 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/disk/ccd/ccd.c
+++ b/sys/dev/disk/ccd/ccd.c
@@ -511,6 +511,11 @@
 	 * Don't allow the interleave to be smaller than
 	 * the biggest component sector.
 	 */
+	if (maxsecsize == 0) {
+		/* No usable component sector size (e.g. zero components). */
+		error = EINVAL;
+		goto fail;
+	}
 	if ((cs->sc_ileave > 0) &&
 	    (cs->sc_ileave % (maxsecsize / DEV_BSIZE))) {
 #ifdef DEBUG
@@ -1316,7 +1321,13 @@
 		if ((error = ccdlock(cs)) != 0)
 			return (error);
 
-		if (ccio->ccio_ndisks > CCD_MAXNDISKS) {
+		/*
+		 * DF-2432: reject a zero-component configuration.  ccdinit() uses
+		 * the maximum component sector size as a divisor (ccd.c:515 and
+		 * :580); with zero components that value stays 0 and the ioctl
+		 * takes a divide-by-zero (#DE) fault.
+		 */
+		if (ccio->ccio_ndisks == 0 || ccio->ccio_ndisks > CCD_MAXNDISKS) {
 			ccdunlock(cs);
 			return (EINVAL);
 		}