cb_dumpdata() has no PAGE_SIZE floor on di->maxiosize: a dump device reporting sub-page si_iosize_max makes chunk==0 and spins the panic-dump loop forever (no dump, silent hang)
Summary
max_iosize = min(MAXPHYS, di->maxiosize) is trusted verbatim from dev->si_iosize_max (subr_disk.c:934): a driver registering 512..4095 makes chunk = max_iosize/PAGE_SIZE == 0 while pgs > 0 - the while(pgs) loop issues zero-length dev_ddump forever (no dump, no error, no reset; only console CTRL-C breaks it). No in-tree dump device triggers it today (da/nvme/virtio/md/ahci/virtio_scsi/ips all PAGE_SIZE+). Panic-path forensics-loss hardening; root-config + future/third-party driver precondition. Runtime negative evidence: two guest FULL dumps byte-exact (savecore-validated, dumpscan p_offset chain contiguous incl. the segment DF-5535 drops); exact-fit crashdumpmap window proven. PAGE_SIZE-floor fix proposed for both dump paths.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5567 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testableConfirmed kernel references
- sys/platform/pc64/x86_64/dump_machdep.c:168
- sys/dev/disk/subr_disk.c:934
Detail
Evidence (decisive lines)
static: dump_machdep.c:168,175-177 integer division without floor; runtime negative pack findings/poc/neg-evidence-dumpmachdep-pass2/
Verified recommended fix
max_iosize = MAX(PAGE_SIZE, min(MAXPHYS, di->maxiosize)) in both dump paths
Verdict
untested (Info hardening; needs a synthetic si_iosize_max=512 dump driver; code-level proof complete: chunk==0 -> pgs never advances)
No comments yet.