DF-2426
Divide-by-zero panic via XPT_CALC_GEOMETRY with block_size == 0
Summary
XPT_CALC_GEOMETRY handler computes ccg->volume_size/((1024L*1024L)/ccg->block_size) without verifying block_size non-zero. Raw CCB with block_size=0 (freely settable through pass CAMIOCOMMAND ioctl) traps kernel in integer divide-by-zero panicking system. ccg->block_size u_int32_t taken directly from CCB with no zero check. passsendccb -> xpt_merge_ccb reaches amd_action unchanged.
No comments yet.