DF-4228 — cyapa: root-writable debug sysctls feed an integer divide-by-zero in cyapa_poll_thread (kernel panic)

Where

sys/dev/smbus/cyapa/cyapa.c

• cyapa.c:227-235 — cyapa_idle_freq (1), cyapa_slow_freq (20), cyapa_norm_freq (100) are module globals exported RW via SYSCTL_INT(_debug, OID_AUTO, …, CTLFLAG_RW, …) with no bounds.
• cyapa.c:1200 — the poll thread computes its sleep interval: tsleep(&sc->poll_flags, 0, "cyapw", (hz + freq - 1) / freq);
• cyapa.c:1202-1210 — freq is re-assigned from one of the three sysctls every iteration (idle/slow/norm depending on open+activity state).

Bug

sysctl debug.cyapa_idle_freq=0 (or slow/norm) — root-writable, no validation — makes the next poll iteration execute (hz + 0 - 1) / 0: integer division by zero inside a kernel thread → #DE trap → kernel panic. Negative values make tsleep take a negative timeout (separate misbehavior).

PoC

• model_div0.c executes the identical arithmetic in the identical integer types: raises SIGFPE in userspace (in kernel context: #DE → panic). Observed on the audit guest: RESULT: SIGFPE - integer division by zero raised (run.log).
• On real hardware the one-liner is: sysctl debug.cyapa_idle_freq=0 (any state with the device attached; the idle frequency is selected whenever sc->count == 0, i.e. even with no process holding the device open).

Guest evidence (this run)

The sysctls register at module load (kldload cyapa.ko — see run.log) and accept a write of 0 without panicking because the poll thread only exists once the driver attaches to hardware — no SMBus controller/trackpad exists in QEMU, so the division never executes here. The fault itself is source-certain and demonstrated by the harness.

Fix

Clamp: if (freq < 1) freq = 1; before use (or use imax(freq,1)), plus sysctl validation. See fix.diff.

Build / run

cc -O0 -Wall -o model_div0 model_div0.c
./model_div0

DF-4228 — VERDICT

Status: untested (kernel-side panic not exercisable on this guest — the poll thread exists only after the driver attaches to hardware, which requires a Cypress APA trackpad on SMBus addr 0x67; the arithmetic fault itself is demonstrated by harness and is source-certain).

Root cause (line-accurate)

• cyapa_idle_freq / cyapa_slow_freq / cyapa_norm_freq are static ints exported read-write at cyapa.c:227-235 (SYSCTL_INT(..., CTLFLAG_RW, ...)) with no range enforcement — debug.* sysctls are root-writable.
• cyapa_poll_thread (cyapa.c:1161) unconditionally computes (hz + freq - 1) / freq at cyapa.c:1200 each iteration.
• freq is refreshed from the sysctl globals at cyapa.c:1202-1210 (idle freq chosen whenever sc->count == 0 — i.e. with no open fd, slow when idle, norm otherwise).
• freq = 0 ⇒ integer division by zero in kernel thread context ⇒ x86-64 #DE exception in CPL0 ⇒ kernel panic.

What ran on the guest

1. model_div0.c — identical expression (hz + freq - 1) / freq with the identical types (int hz, int freq), freq=0: SIGFPE on the division (run.log: "RESULT: SIGFPE - integer division by zero raised").
2. Module lifecycle (run.log, shared with DF-4227 pack): - kldload cyapa.ko → debug.cyapa_* sysctls appear (registered at module load, device or not). - sysctl debug.cyapa_norm_freq=0 accepted → guest stayed up, because cyapa_poll_thread was never started (no attach). This confirms the write path works and only the hardware-gated thread is missing.

Impact

Root-only trigger (debug.* sysctl write), but it is a one-syscall deterministic kernel panic on any machine with the trackpad (Acer C720 class laptops). Low severity, DoS class.

Recommended fix

Clamp before the division (and ideally validate on sysctl write):

if (freq < 1)
        freq = 1;

See fix.diff (applies clean against sys/).

Fix validation

Not possible on this guest (poll thread unreachable). fix_status = not_testable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.