DF-0234 — DF-0234 — Signed-integer overflow in callout timer calc (min_period * hz / 2)

See VERDICT.md for the full root-cause analysis and reachability.

Reproduce

./build.sh && ./run.sh

(For DF-0234 the bug is confirmed at source level; on this QEMU guest the vulnerable path is latent / timing-dependent — see VERDICT.md "Reachability".)

Fix

fix.diff is a standalone git apply\ -able patch. Validated to apply clean (git apply --check) and compile in a single all-fixes kernel build (all_fixes_build.log, rc=0, no errors).

DF-0234 — Signed-integer overflow in callout timer calc (min_period * hz / 2)

Verdict: REPRODUCED (source-level) / LATENT on this guest. Impact: DoS — CPU-burn (self-perpetuating callout) or watchdog-defeat, not memory corruption; no escalation chain.

The bug

sys/kern/kern_wdog.c, wdog_reset_all():

84: static int
85: wdog_reset(struct watchdog *wd)
86: {
87:     return (wd->period = wd->wdog_fn(wd->arg, wd->period));
88: }
90: static void
91: wdog_reset_all(void *unused)
92: {
93:     struct watchdog *wd;
94:     int period, min_period = INT_MAX;       /* <-- starts at INT_MAX */
...
99:     LIST_FOREACH(wd, &wdoglist, link) {
100:         period = wdog_reset(wd);            /* driver-returned period */
101:         if (period < min_period)
102:             min_period = period;
103:     }
104:     if (wdog_auto_enable) {
105:         callout_reset(&wdog_callout, min_period * hz / 2,   /* <-- SIGNED overflow */
106:                       wdog_reset_all, NULL);
107:     }

min_period is an int initialised to INT_MAX and may be set to a driver-returned wd->wdog_fn(...) value (also int, wd->period). The expression min_period * hz is computed in int. With hz == 1000, any min_period > INT_MAX/hz (≈ 2 147 483) makes min_period * hz overflow signed int → negative/garbage. callout_reset() then gets a bogus tick count: a small/zero/negative value arms the callout immediately → the self- rescheduling wdog_reset_all callback burns CPU; a large wrapped value can fail to re-arm the watchdog → hardware reset. The finding's INT_MAX-init path is the obvious trigger; a driver bug returning a huge period is the other.

Reachability on this guest (LATENT)

• The only in-tree wdog_register() callers are hardware watchdog drivers amdsbwd.c:519 (AMD SB7xx/SB8xx watchdog) and ichwd.c:593 (Intel ICH watchdog). Neither device is present in this QEMU/KVM guest — dmesg shows no wdog: Watchdog ... registered line, only the subsystem init message. So wdog_reset_all() returns early at if (LIST_EMPTY(&wdoglist)) (line 97) on every invocation and the overflow arithmetic is never reached.
• kern.watchdog.period is root-writable, but wdog_set_period()+wdog_reset_all() also hit the empty-list early return, so the sysctl cannot trigger the multiply either.
• Conclusion: the signed-overflow arithmetic is real and confirmed by trace, but it is latent on this guest — it requires a registered hardware watchdog (amdsbwd/ichwd on real hardware) that returns/can be coaxed toward an INT_MAX-class period. This is a confirmed source-level bug, not a false positive; runtime triggering needs the HW driver.

The fix

fix.diff clamps min_period to INT_MAX / hz before the multiply so min_period * hz can never overflow a signed int. (The companion DF-0236 fix restructures the same function to release the spinlock around callbacks.)

Kernel refs

• sys/kern/kern_wdog.c:94 — min_period = INT_MAX
• sys/kern/kern_wdog.c:105 — min_period * hz / 2 signed overflow
• sys/dev/misc/amdsbwd/amdsbwd.c:519, sys/dev/misc/ichwd/ichwd.c:593 — only wdog_register callers