Signed divide/modulo by -1 on LONG_MIN triggers #DE trap leaking db_active wedging system after DDB exit
Summary
db_mult_expr guards division/modulo against rhs==0 (db_expr.c:147) but NOT against LONG_MIN/-1 quotient-overflow case which on x86 raises #DE (divide-error) trap from idivq instruction. rhs=-1 reachable via parenthesized sub-expression db_term parses (0-1) through recursive db_expression. #DE trap recovered by longjmp(db_global_jmpbuf) in kdb_trap but longjmp targets setjmp at db_interface.c:170 re-executing db_active++ at :172. After operator types continue db_active decremented from 2 to 1 (not 0) so trap.c:420 routes every subsequent kernel trap through trap_fatal->DDB re-entry. System drops back into DDB on next page fault timer interrupt syscall permanently wedged until reboot. Trigger expression: 0x8000000000000000 % (0-1). DDB-only privileged context no privilege escalation but subtle non-obvious PERSISTENT DoS operator types innocent-looking arithmetic expression. Production incident-response scenario admin drops into DDB types debugging expression system permanently wedged crash dump/forensics lost compounds original outage.
No comments yet.