DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2293

Zero bufreq.psize passed to FW_STSTREAM/FW_SRSTREAM causes divide-by-zero panic in fwdma_malloc_multiseg

Summary

fwdev_allocbuf forwards user-controlled bufspec straight into fwdma_malloc_multiseg with no validation of psize. If caller has not first issued FW_SSTBUF (so d->bufreq.tx/rx still zero from M_ZERO allocation) or explicitly set psize=0 the rounddown(PAGE_SIZE esize) macro inside fwdma_malloc_multiseg performs integer division by zero panicking kernel. Any operator-group user can crash system with two syscalls (open + FW_STSTREAM).

Discussion (0)

No comments yet.