Divide-by-zero in iir_init from HBA-supplied mapping fields with zero heads or secs
Summary
iir_init at iir.c:413-420: if sc_info2!=0: drv_hds=sc_info2&0xff, drv_secs=(sc_info2>>8)&0xff, drv_cyls=hd_size/drv_hds/drv_secs. Only sc_info2==0 special-cased. Non-zero sc_info2 with heads=0 or secs=0 -> div-by-zero panic at attach. Buggy/malicious HBA. Fix: check drv_hds!=0 && drv_secs!=0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1426 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 810 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 979 B | view raw |
DF-1426 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
Divide-by-zero in iir_init from HBA-supplied mapping fields with zero heads or secs
Source Location
sys/dev/raid/iir/iir.c:413-420
Verdict
Source-confirmed: Divide-by-zero in iir_init from HBA-supplied mapping fields with zero . Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
iir_init at iir.c:413-420: if sc_info2!=0: drv_hds=sc_info2&0xff, drv_secs=(sc_info2>>8)&0xff, drv_cyls=hd_size/drv_hds/drv_secs. Only sc_info2==0 special-cased. Non-zero sc_info2 with heads=0 or secs=0 -> div-by-zero panic at attach. Buggy/malicious HBA. Fix: check drv_hds!=0 && drv_secs!=0.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: iir_init divides by drv_hds/drv_secs from HBA-supplied sc_info2 fields without zero guard. Added zero check. HW-gated.
Verified recommended fix
Source-confirmed: iir_init divides by drv_hds/drv_secs from HBA-supplied sc_info2 fields without zero guard. Added zero check. HW-gated.
Verdict
Source-confirmed: iir_init divides by drv_hds/drv_secs from HBA-supplied sc_info2 fields without zero guard. Added zero check. HW-gated.
No comments yet.