DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2451

Divide-by-zero in dm_pdev_correct_dump_offset when DIOCGPART failed at insert

Summary

dm_pdev_insert zeroes pdev_pinfo calls DIOCGPART on error only kprintf the dmp still inserted into global list with media_blksize==0. dm_pdev_correct_dump_offset computes media_offset/media_blksize (:107) dividing by zero. Only reachable from kernel crash-dump path (dev_ddump -> dm_target_*_dump -> dm_pdev_correct_dump_offset) so attacker cannot self-trigger at most converts recoverable panic into double-panic preventing crash dump from being written.

Discussion (0)

No comments yet.