ata-lowlevel: divide-by-zero panic in ata_tf_write CHS path from device-supplied zero geometry
Summary
ata_tf_write CHS path at ata-lowlevel.c:771 reads heads/sectors from atadev->param.current_heads/current_sectors (if atavalid & ATA_FLAG_54_58) or atadev->param.heads/sectors - raw u16 from IDENTIFY DEVICE response NO validation non-zero. Line 783 ATA_IDX_OUTB(ch, ATA_SECTOR, (request->u.ata.lba % sectors)+1) sectors==0 div-by-zero. Line 785 divides by sectors*heads. ata-disk.c:485-486 sets ATA_D_USE_CHS when version_major unsupported or lba_size=0. Malicious ATA device: IDENTIFY words 1/3/6=0 word 53 bit 0 clear word 0 major_version=0 -> ATA_D_USE_CHS -> first I/O lba!=0 -> #DE trap panic.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1738 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Validate sectors!=0 && heads!=0 before the CHS divisions. | 452 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1738 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/disk/nata/ata-lowlevel.c:771-785.
Mechanism
ata_tf_write CHS path reads heads/sectors from IDENTIFY response without validating non-zero; sectors==0 causes div-by-zero (#DE trap) on first CHS I/O.
Fix
Validate sectors!=0 && heads!=0 before the CHS divisions.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
nata module built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- n
- a
- t
- a
- /
- a
- t
- a
- -
- l
- o
- w
- l
- e
- v
- e
- l
- .
- c
- :
- 7
- 7
- 1
- -
- 7
- 8
- 5
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/disk/nata/ata-lowlevel.c:771-785. Fix compiled clean.
PoC changes
authored fix.diff: validate sectors!=0 && heads!=0
Verified recommended fix
Validate sectors!=0 && heads!=0 before CHS divisions. Matches finding proposal.
Verdict
REPRODUCED (source-only). CHS path divides by sectors/heads from IDENTIFY without !=0 validation; sectors==0 causes #DE trap.
No comments yet.