DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2297

Divide-by-zero in fwdma_malloc_multiseg when esize is zero

Summary

fwdma_malloc_multiseg computes ssize=rounddown(PAGE_SIZE esize) without checking esize==0. rounddown macro expands to ((PAGE_SIZE)/(esize))*(esize) causing integer divide-by-zero (CPU #DE -> kernel panic) when esize is zero. Caller fwdev_allocbuf passes b->psize as esize after roundup2(b->psize 4) and roundup2(0 4)==0 so user-supplied psize=0 reaches this division. Same bug chain as DF-2293 (filed against fwdev.c); the division itself executes in fwdma.c:159. Second div-by-zero path: psize>=0x80000001 cast to int esize negative making rounddown(4096 negative) yield ssize=0 then howmany(n 0/esize) divides by zero at :160.

Discussion (0)

No comments yet.