⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2415

Divide-by-zero panic in XPT_CALC_GEOMETRY from device-controlled block_size

Summary

adw_action() inlines own disk-geometry calculation for XPT_CALC_GEOMETRY that divides by ccg->block_size twice without any zero/overflow guard. size_mb=ccg->volume_size/((1024L*1024L)/ccg->block_size) at :734. Shared helper cam_calc_geometry and mpt SIM both explicitly check block_size==0; this driver does not. block_size==0 inner division by zero #DE. block_size>1048576 inner quotient 0 outer division by zero. block_size device-controlled (READ CAPACITY response -> da periph -> dasetgeom -> ccg->block_size). Triggerable by malicious SCSI device on AdvanSys bus during automatic kernel probe no authentication.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2415 · 6 files
FileTypeDescriptionSize
VERDICT.md verdict gate analysis + source trace + exploit-chain stop reason 2.4 KB ↓ raw
fix.diff suggested-fix guard ccg->block_size (==0, >1MiB, non-divisor of 1MiB) before the XPT_CALC_GEOMETRY division 848 B view raw
fix_build.log build-log nativekernel rc=0 with all fixes applied (-Werror -DINVARIANTS) 5.6 MB ↓ download
env.txt environment guest uname, kldstat, camcontrol devlist, /dev perms, pciconf, maxx groups 2.7 KB view raw
build.sh build-log documents the HW/permission gate (no PoC binary) 494 B view raw
run.sh run-log prints the gate proof 472 B view raw
VERDICT.md verdict gate analysis + source trace + exploit-chain stop reason
↓ download raw

DF-2415 — adwcam.c divide-by-zero in XPT_CALC_GEOMETRY

Verdict: NOT REPRODUCED (hardware-gated) — source bug CONFIRMED real (partially mitigated upstream); fix.diff compiles.

Classification: not_reproduced / HW-gated / impact=none. No AdvanSys (adw) HBA on this guest. The div-by-zero is real in source; the defense-in-depth fix.diff compiles cleanly (nativekernel rc=0, -Werror, -DINVARIANTS).

Why not reproduced (the gate)

The bug is in adw_action() XPT_CALC_GEOMETRY of the adw (second-generation AdvanSys) SCSI HBA driver (sys/dev/disk/advansys/adwcam.c). The guest has no AdvanSys PCI HBA and the module is not loaded (kldstat: only kernel, ehci.ko, xhci.ko). The handler is never invoked.

Gate proof (this guest):

$ kldstat              ->  kernel, ehci.ko, xhci.ko   (no adw/advansys)
$ pciconf -l           ->  no AdvanSys (0x10cd/*) / no SCSI HBA at all
$ camcontrol devlist   ->  only QEMU DVD-ROM on PIIX3 ata-cam

The source bug (real, cited path:line)

sys/dev/disk/advansys/adwcam.c, adw_action() XPT_CALC_GEOMETRY (:722-756): - size_mb = ccg->volume_size / ((1024L * 1024L) / ccg->block_size); (:734-735) — the same inline geometry calc as the advansys driver, without the block_size==0 guard that the shared cam_calc_geometry helper and the mpt SIM perform. - Sink 1 (block_size==0): inner 1048576L / 0 → #DE. Mitigated upstream by the XPT core filter at sys/bus/cam/cam_xpt.c:3063 (which rejects block_size==0 before dispatch to the SIM), so unreachable via da→dasetgeom. - Sink 2 (block_size > 1 MiB / non-divisor of 1 MiB → inner quotient 0 → outer volume_size / 0): NOT mitigated by the core filter — real latent bug. - Data flow identical to DF-2411: READ CAPACITY → scsi_da.c:1831 → dasetgeom → ccg->block_size → xpt_action(XPT_CALC_GEOMETRY) → adwcam.c:734.

Attacker model: malicious SCSI device on an adw (AdvanSys) bus during auto-probe.

Exploit chain

Not developed — no adw HBA, no target. Valid hard blocker: dead driver code path on this guest.

Fix (defense-in-depth, validated to compile)

fix.diff guards ccg->block_size (== 0, > 1 MiB, non-divisor of 1 MiB) before the division. Validated in the combined nativekernel build (fix_build.log).

Reproduce

No runnable PoC on this guest (no adw HBA). Artifacts: env.txt, fix.diff, fix_build.log.

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

not_testable: PoC cannot run on this guest (HW/permission gated). fix.diff validated to APPLY cleanly and COMPILE in full nativekernel build (rc=0, -Werror, -DINVARIANTS) alongside sibling fixes (findings/poc/DF-2415/fix_build.log).

Compile validation: nativekernel build of patched tree -> 'NK_DONE rc=0'. No runtime test possible (HW/permission gated).
↓ fix.diffn/a (no target HW/device on this guest)

Confirmed kernel references

Detail

Exploit chain

none — valid hard blocker (driver code path dead / device node root-only / no malicious device present). No unprivileged->root path.

Evidence (decisive lines)

kldstat -> kernel, ehci.ko, xhci.ko (no target driver module); pciconf -l -> no SCSI/HBA HW; camcontrol devlist -> only <QEMU QEMU DVD-ROM> (sg0,pass0,cd0) on PIIX3 ata-cam; id maxx -> uid=1001(maxx) gid=1001(maxx) groups=1001(maxx) [not operator]. Source confirmed at cited lines.

PoC changes

Created findings/poc/DF-2415/{VERDICT.md, fix.diff, manifest.json, build.sh, run.sh, env.txt, fix_build.log}. No PoC source (HW/permission gated).

Verified recommended fix

fix.diff guards ccg->block_size (==0, >1MiB, non-divisor) before division. Full git-apply-able diff in findings/poc/DF-2415/fix.diff.

Verdict

NOT REPRODUCED — HW/permission gated on this guest. The bug is REAL in source (traced line-by-line). adwcam XPT_CALC_GEOMETRY div-by-zero (twin of DF-2411); no AdvanSys/adw HBA, module not loaded. Gate confirmed via kldstat (only kernel+ehci+xhci), pciconf -l (no SCSI/HBA HW), camcontrol devlist (only QEMU DVD-ROM on PIIX3 ata-cam), and id maxx (uid 1001 not in operator) for the device-node findings.