DF-1116 — Integer divide-by-zero in fwdma_malloc_multiseg (FireWire)

Finding

fwdma_malloc_multiseg at sys/bus/firewire/fwdma.c:159 computes ssize = rounddown(PAGE_SIZE, esize) which expands to (PAGE_SIZE / esize) * esize (sys/sys/param.h:400). With esize == 0 this is integer divide-by-zero → kernel #DE trap → panic at sys/platform/pc64/x86_64/trap.c:1101.

esize is b->psize passed from fwdev_allocbuf (sys/bus/firewire/fwdev.c:108) after roundup2(b->psize, 4) which is identity for 0 (fwdev.c:107). psize = 0 is user-supplied via the unchecked FW_SSTBUF ioctl (fwdev.c:504-506 bcopy(ibufreq, &d->bufreq, ...)).

Trigger path: FW_STSTREAM / FW_SRSTREAM → fwdev_allocbuf → fwdma_malloc_multiseg(esize=0) → #DE.

Reachability on this guest

NOT reachable. The FireWire driver (firewire.ko) is loadable but no FireWire controller is present in the QEMU guest (pciconf -lv shows no 1394 OHCI device), so the driver never attaches and /dev/fwN.M is never created. The bug is real and deterministic but latent on this host.

A userspace harness reproduces the arithmetic primitive (SIGFPE = the user-mode analogue of kernel #DE).

Build / Run / Expected

cc -O2 -o harness harness.c     # build.sh
./harness                        # run.sh
# Expected: "SIGFPE: integer divide by zero -- primitive reproduced."

Files

• harness.c — standalone reproduction of the div-by-zero arithmetic.
• fix.diff — adds if (esize <= 0 || n <= 0) return (NULL); at fwdma_malloc_multiseg + defense-in-depth check in fwdev_allocbuf.
• build.log / run.log / env.txt — captured outputs.

VERDICT — DF-1116

Verdict: REPRODUCED (primitive) / NOT REACHABLE on guest (HW-gated)

The cited bug is real and confirmed by source trace + userspace arithmetic reproduction. It is a latent kernel-panic primitive: reachable only when a FireWire controller is attached, which this audit guest does not have.

Mechanism (confirmed path:line)

1. FW_SSTBUF ioctl (sys/bus/firewire/fwdev.c:504-506): user-supplied ibufreq is bcopy'd into d->bufreq with no validation of psize/nchunk/npacket. A local user in group operator (device perms 0660 root:operator per fwdev.c:173-175) can set psize = 0.
2. FW_STSTREAM / FW_SRSTREAM (fwdev.c:447 / :475) → fwdev_allocbuf(fc, ir/it, &d->bufreq.tx/rx).
3. fwdev_allocbuf (fwdev.c:107): b->psize = roundup2(b->psize, 4) — identity for 0. Passes b->psize as esize to fwdma_malloc_multiseg (fwdev.c:108-109).
4. fwdma_malloc_multiseg (fwdma.c:159): ssize = rounddown(PAGE_SIZE, esize) → (4096 / 0) * 0 → #DE trap.
5. Trap → panic at sys/platform/pc64/x86_64/trap.c:1101.

No priv_check on the ioctl path; only file-permission gating.

Reproduction (userspace harness)

The harness reproduces the arithmetic primitive in userspace. volatile defeats constant-folding (div-by-zero is UB; gcc would fold it at -O2 without this). On x86, integer div-by-zero raises SIGFPE (the user-mode analogue of kernel #DE):

SIGFPE: integer divide by zero -- primitive reproduced.
In kernel context this is a #DE trap -> panic (trap.c:1101).

Impact ceiling

• Per-call: deterministic kernel panic (DoS). Single-threaded, 100% reproducible. No memory-corruption primitive — the trap fires before any write completes.
• Privilege boundary: operator group → kernel panic. Not unpriv→root; not even unpriv→DoS unless the user is in operator or the device is world-writable.
• Realistic: requires a FireWire controller attached. Modern systems rarely have FW; legacy/scientific imaging setups do.

Fix

fix.diff adds two guards: 1. fwdma_malloc_multiseg (fwdma.c): if (esize <= 0 || n <= 0) return (NULL); at the top — rejects the degenerate request before the divide. 2. fwdev_allocbuf (fwdev.c): if (b->psize == 0 || b->nchunk == 0 || b->npacket == 0) return (EINVAL); — defense-in-depth at the caller.

Validated: firewire.ko builds with rc=0 after applying the fix.

Fix validation

• Patch applies cleanly: Hunk #1 succeeded at 150 (fwdma.c) + Hunk #1 succeeded at 105 (fwdev.c).
• make in sys/bus/firewire/ → firewire.ko linked, RC=0.
• Cannot boot-test the fix (no FireWire HW on guest); fix_status: not_testable per the HW-gated allowance. The fix compiles and is a trivial guard.

PoC changes

• harness.c written from scratch (no prior PoC). Reproduces the arithmetic primitive; volatile prevents the compiler from eliding the div-by-zero.