DF-2432 — Divide-by-zero kernel panic via CCDIOCSET with ccio_ndisks=0

Verdict: REPRODUCED (local DoS / kernel panic), then FIXED and VALIDATED.

Mechanism (confirmed, path:line)

CCDIOCSET (sys/dev/disk/ccd/ccd.c:1309, sys/sys/ccdvar.h:238) only validates the component count against its upper bound:

if (ccio->ccio_ndisks > CCD_MAXNDISKS) {   /* ccd.c:1319 — no lower bound! */
    ccdunlock(cs);
    return (EINVAL);
}

It never rejects ccio_ndisks == 0. With zero disks:

1. kmalloc(0 * sizeof(char *)) and kmalloc(0 * sizeof(struct vnode *)) return the non-NULL ZERO_LENGTH_PTR, so the allocation checks pass (ccd.c:1350-1353); copyin(..., 0) is a no-op (ccd.c:1355); and the component-lookup loop runs zero times (ccd.c:1372).
2. ccdinit() then runs: cs->sc_nccdisks = ccd->ccd_ndev = 0 (ccd.c:402); kmalloc(0 * sizeof(struct ccdcinfo)) again yields ZERO_LENGTH_PTR (ccd.c:405); and the per-component loop (ccd.c:418) runs zero times, so maxsecsize stays 0 (ccd.c:416).
3. The pseudo-geometry setup divides by it: c ccg->ccg_secsize = maxsecsize; /* = 0 */ ccg->ccg_nsectors = 1024 * 1024 / ccg->ccg_secsize;/* 1048576 / 0 -> #DE */ (ccd.c:578-580). If ccio_ileave > 0 the earlier divide sc_ileave % (maxsecsize / DEV_BSIZE) == x % 0 (ccd.c:515) faults first. Either way the CPU raises a divide error (#DE, trap 18) and the kernel panics.

Reproduction (unpatched #0 baseline)

poc.c opens /dev/ccd0 (O_WRONLY, satisfying the FWRITE check at ccd.c:1313) and issues ioctl(fd, CCDIOCSET, &ccio) with ccio_ndisks=0, ccio_ileave=0, ccio_flags=0. Run as root after kldload ccd.

Observed (panic.txt, serial console):

Fatal trap 18: integer divide fault while in kernel mode
instruction pointer = 0x8:0xffffffff82600e28
Stopped at      ccdinit+0x578:  divl    %esi,%eax
db>

Guest went down (ssh died). 100% reliable.

Impact ceiling (realistic)

This is a divide-by-zero DoS, not memory corruption — no escalation chain. The trigger requires: - kldload ccd (root), and - opening /dev/ccd0 with O_WRONLY — /dev/ccd0 is crw-r----- root:operator, so the caller needs root or membership in the operator group. The unprivileged test user (maxx, uid 1001) is not in operator, so it is a root→kernel DoS. (A real deployment that pre-loads ccd and grants an account operator would expose it as an unprivileged local DoS; that is a deployment choice, not the default.)

The fix (fix.diff)

Root-cause: reject a zero-component configuration at the CCDIOCSET layer, and add a defense-in-depth guard against maxsecsize == 0 in ccdinit():

1. ccd.c:1330 — if (ccio->ccio_ndisks == 0 || ccio->ccio_ndisks > CCD_MAXNDISKS) returns EINVAL.
2. ccd.c:515 — if (maxsecsize == 0) { error = EINVAL; goto fail; } before the divides at :519/:580.

Fix validation (rebuilt + reloaded ccd.ko, same #0 kernel base)

ccd is a loadable kld module, so the fix was validated without a kernel reboot: rebuilt ccd.ko standalone from /usr/src/sys/dev/disk/ccd, copied it to /boot/kernel/ccd.ko, and kldload-ed it on the running kernel.

Fixed ccd.ko SHA256: 5189556a9a0aee32ac340f408e3a088d84a6cb1110c9c282ef5f43500047595f. The fix closes the bug cleanly (EINVAL replaces the #DE panic).

Files

• poc.c — CCDIOCSET with ccio_ndisks=0 → divide-by-zero.
• build.sh / run.sh — cc the PoC; kldload ccd && ./poc /dev/ccd0.
• panic.txt — Fatal trap 18 … ccdinit+0x578 serial-log signature.
• run.log — fixed-module run: CCDIOCSET rejected: Invalid argument, guest up.
• run.2.log, run.3.log — determinism re-runs (×3/3 EINVAL).
• fix.diff — git apply-able: reject ndisks==0 + guard maxsecsize==0.
• fix_build.log — standalone ccd.ko build log (compiles clean).
• fix_env.txt — kern.version, fixed ccd.ko sha256, kldstat.
• env.txt — guest uname, cc, /dev/ccd0 perms, maxx groups.