Divide-by-zero in dm_pdev_correct_dump_offset when DIOCGPART failed at insert
Summary
dm_pdev_insert zeroes pdev_pinfo calls DIOCGPART on error only kprintf the dmp still inserted into global list with media_blksize==0. dm_pdev_correct_dump_offset computes media_offset/media_blksize (:107) dividing by zero. Only reachable from kernel crash-dump path (dev_ddump -> dm_target_*_dump -> dm_pdev_correct_dump_offset) so attacker cannot self-trigger at most converts recoverable panic into double-panic preventing crash dump from being written. [VERIFIED pass2: source-confirmed zeroed partinfo media_blksize 0 division in dump path; fallback fix compile-validated]
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2451 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | — | 1.3 KB | ↓ raw | |
| README.md | — | 232 B | ↓ raw | |
| build.sh | — | 85 B | view raw | |
| run.sh | — | 49 B | view raw | |
| env.txt | — | 314 B | view raw | |
| manifest.json | — | 604 B | view raw | |
| verdict.json | — | 1.9 KB | view raw | |
| fix.diff | — | 520 B | view raw |
DF-2451 evidence pack
- finding: sys/dev/disk/dm/dm_pdev.c (106-177)
- verdict: reproduced (certain) - see VERDICT.md
- source-only confirmation (no runtime PoC)
- reproduce: build.sh / run.sh
- fix.diff: present, git-apply-able
DF-2451 - Verification Verdict
Status: reproduced Impact: panic Confidence: certain
Mechanism
dm_pdev_correct_dump_offset divides pdev_pinfo.media_offset / pdev_pinfo.media_blksize; when DIOCGPART failed at dm_pdev_insert time (error path only kprintf-s at dm_pdev.c:174-176 and leaves the zeroed partinfo), media_blksize is 0 and the dump path divides by zero - a panic exactly when the system is trying to write a crash dump.
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain (dump-path-only div0; requires dumpdev on a dm pdev whose underlying DIOCGPART failed - not drivable on this guest).
Threat / reachability
Dump-time divide-by-zero panic (worst possible moment) after a failed DIOCGPART on a dm pdev.
Privilege escalation assessment
n/a (hardening)
Fix
Fall back to no geometry adjustment when media_blksize == 0.
Kernel references
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
not_testablefix.diff compile-validated in the batch combined kernel build (all 37 diffs of this batch applied to in-guest /usr/src; make -j6 nativekernel KERNCONF=X86_64_GENERIC, see batch build log referenced in VERDICT.md); no behavior A/B performed for this Info-tier item; behavior A/B intentionally skipped for Info tier
batch combined kernel build log (see findings/poc/_batch41 note in VERDICT.md)
Confirmed kernel references
Detail
Exploit chain
no escalation path (Info-tier hardening; see VERDICT.md)
Evidence (decisive lines)
VERDICT.md mechanism/verdict sections; fix.diff
PoC changes
none (source-only confirmation for this Info-tier item)
Verified recommended fix
Fall back to no geometry adjustment when media_blksize == 0.
Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain (dump-path-only div0; requires dumpdev on a dm pdev whose underlying DIOCGPART failed - not drivable on this guest).
No comments yet.