DF-2451
Divide-by-zero in dm_pdev_correct_dump_offset when DIOCGPART failed at insert
Summary
dm_pdev_insert zeroes pdev_pinfo calls DIOCGPART on error only kprintf the dmp still inserted into global list with media_blksize==0. dm_pdev_correct_dump_offset computes media_offset/media_blksize (:107) dividing by zero. Only reachable from kernel crash-dump path (dev_ddump -> dm_target_*_dump -> dm_pdev_correct_dump_offset) so attacker cannot self-trigger at most converts recoverable panic into double-panic preventing crash dump from being written.
No comments yet.