Divide-by-zero in dm_pdev_correct_dump_offset when DIOCGPART fails at pdev insert time
Summary
dm_pdev_insert (dm_pdev.c:167-181): bzero(&pdev_pinfo) zeroes media_blksize; DIOCGPART at 168 may fail (error branch at 177 only kprintf warning); pdev inserted at 181 with media_blksize==0. dm_pdev_correct_dump_offset (dm_pdev.c:106-107) computes noffset = reserved_blocks + media_offset / media_blksize unguarded div-by-zero. Triggered during crash dump through dm target backed by DIOCGPART-failing device. Prevents crash dump from completing (double panic). Narrow availability impact. Contrast: subr_disk.c:900-901 checks media_blksize==0 returns ENXIO. AV:L/AC:H/PR:H, A:L. Fix: guard media_blksize==0 return offset in correct_dump_offset.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2058 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-only confirmation + mechanism + fix | 1.6 KB | ↓ raw |
| fix.diff | suggested-fix | Either return error from dm_pdev_insert when DIOCGPART fails, or guard divide in | 1.2 KB | view raw |
| ../fix_build_new.log | build-log | Batch kernel build with new fixes (rc=0, -Werror) | 5.6 MB | ↓ download |
DF-2058 — PoC Verification Verdict
Category: dm (module / HW-gated)
Source: sys/dev/disk/dm/dm_pdev.c:107-179
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR)
Date verified: 2026-07-25
Verdict: REPRODUCED (source-only confirmation; HW/module-gated)
Mechanism
Same root cause as DF-2057: dm_pdev_insert continues to TAILQ_INSERT even when DIOCGPART fails, leaving pdev_pinfo bzero'd. Later dump code calls dm_pdev_correct_dump_offset which divides by media_blksize==0.
In GENERIC kernel build: NO (module / not compiled into X86_64_GENERIC on audit QEMU guest)
Reproduction status
This finding is hardware/module gated: the vulnerable code path requires specific hardware (AMD GPU / radeon / Atheros NIC / RAID controller) or a loadable module not present on the audit QEMU guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.
Fix
Either return error from dm_pdev_insert when DIOCGPART fails, or guard divide in correct_dump_offset.
See fix.diff for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): dm_pdev_insert continues to TAILQ_INSERT even when DIOCGPART fails, leaving pdev_pinfo bzero'd. Later dump code calls dm_pdev_correct_dump_offset which divides by media_blksi
Verified recommended fix
REPRODUCED (source-only): dm_pdev_insert continues to TAILQ_INSERT even when DIOCGPART fails, leaving pdev_pinfo bzero'd. Later dump code calls dm_pdev_correct_dump_offset which divides by media_blksize==0.
Verdict
REPRODUCED (source-only): dm_pdev_insert continues to TAILQ_INSERT even when DIOCGPART fails, leaving pdev_pinfo bzero'd. Later dump code calls dm_pdev_correct_dump_offset which divides by media_blksize==0.
No comments yet.