⬢ DragonFlyBSD Kernel Audit
DF-2491 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
{
  "finding_id": "DF-2491",
  "title": "Divide-by-zero panic in CHS-mode ata_tf_write from device-controlled geometry",
  "file": "sys/dev/disk/nata/ata-lowlevel.c",
  "lines": [783, 785, 790],
  "verdict": {
    "status": "reproduced",
    "impact": "panic",
    "confidence": "certain",
    "summary": "Six independent reproductions of Fatal trap 18 (integer divide fault) in the kernel's own static ata_tf_write on the stock INVARIANTS kernel: current_sectors=0 traps at ata_tf_write+0x1f0 (div feeding (lba%sectors)+1, ata-lowlevel.c:783), current_heads=0 traps at +0x218 (lba/(sectors*heads), :785). Includes the full production funnel: a crafted IDENTIFY (word53 valid, current 16/0, raw 16/63, version_major=0) passes the guarded ad_get_geometry (attach survives, ad0 created), the kernel's own gate sets ATA_D_USE_CHS (ata-disk.c:485-486), and the FIRST I/O panics in the kernel's own taskfile writer. Verbatim sha256-gated source copy traps at identical offsets. fix.diff (ata-disk.c guard idiom extended to tf_write + 16/63 clamp) A/B-validated on a rebuilt kernel: all fatal scenarios survive with clamped CHS taskfile, controls bit-identical."
  },
  "reproduce": {
    "build": "vm.sh run_root 'sh /root/dfrig2491/build.sh'  (KLD, sha256-gated verbatim #include of production ata-lowlevel.c; installed to /boot/kernel + loader.conf for boot-time load)",
    "run": "vm.sh run_root 'sh /root/dfrig2491/run.sh 7'  (fatal scenarios 2/3/5/7/9/10 one per boot; controls 1/4/6/8 anytime; or sh findings/poc/DF-2491/cycle.sh 7 from host)",
    "expected": "Stock kernel: 'Fatal trap 18: integer divide fault' + 'Stopped at ata_tf_write+0x1f0: divq %r10,%eax' (sectors=0 variants, :783) / '+0x218: divq %rdi,%eax' (heads=0 variants, :785) on the serial console; funnel variant first prints 'ad0: 0MB <DF2491 ZEROGEOM DISK FW000001>' proving ad_attach survived and CHS mode engaged. Fixed kernel: all scenarios return rc=0, clamped CHS taskfile == sane control."
  },
  "kernel_refs": [
    "sys/dev/disk/nata/ata-lowlevel.c:771",
    "sys/dev/disk/nata/ata-lowlevel.c:783",
    "sys/dev/disk/nata/ata-lowlevel.c:785",
    "sys/dev/disk/nata/ata-lowlevel.c:790",
    "sys/dev/disk/nata/ata-disk.c:469",
    "sys/dev/disk/nata/ata-disk.c:485",
    "sys/dev/disk/nata/ata-disk.c:147",
    "sys/dev/disk/nata/ata-queue.c:98",
    "sys/dev/disk/nata/ata-lowlevel.c:648",
    "sys/dev/disk/nata/ata-all.c:590"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "dfrig2491.c",
    "Makefile",
    "build.sh",
    "run.sh",
    "cycle.sh",
    "build.log",
    "build.fixed-source.log",
    "run_control.log",
    "panic.go2_kernel_sectors0.txt",
    "panic.go3_kernel_heads0.txt",
    "panic.go5_verbatim_sectors0.txt",
    "panic.go7_funnel_sectors0.txt",
    "panic.go9_funnel_heads0.txt",
    "panic.go10_kernel_raw_sectors0.txt",
    "ata_tf_write_trap_disasm.txt",
    "fix_build.log",
    "fix_run.log",
    "fix.diff",
    "env.txt",
    "manifest.json",
    "verdict.json"
  ]
}