DF-2293
Zero bufreq.psize passed to FW_STSTREAM/FW_SRSTREAM causes divide-by-zero panic in fwdma_malloc_multiseg
Summary
fwdev_allocbuf forwards user-controlled bufspec straight into fwdma_malloc_multiseg with no validation of psize. If caller has not first issued FW_SSTBUF (so d->bufreq.tx/rx still zero from M_ZERO allocation) or explicitly set psize=0 the rounddown(PAGE_SIZE esize) macro inside fwdma_malloc_multiseg performs integer division by zero panicking kernel. Any operator-group user can crash system with two syscalls (open + FW_STSTREAM).
No comments yet.