DF-2429
Divide-by-zero in XPT_CALC_GEOMETRY from unvalidated block_size (local DoS / panic)
Summary
XPT_CALC_GEOMETRY handler computes size_mb=ccg->volume_size/((1024L*1024L)/ccg->block_size) with no check block_size non-zero or inner division non-zero. block_size fed directly from SCSI READ CAPACITY response (scsi_da.c:1831 scsi_4btoul(rdcap->length)) no validation or set arbitrarily by pass(4) CAMIOCOMMAND. block_size==0 inner division by-zero. block_size>1MB inner quotient 0 outer division by-zero. Either panics kernel.
No comments yet.