Summary

targbhdtor synchronizes teardown with a fixed sim_lock_sleep(softc, 0, "targbh", hz/2, ...) that has no wakeup source — nobody in the driver ever calls wakeup(softc). targbhdislun aborts ATIOs and IMMED_NOTIFY CCBs but explicitly does not abort in-flight CTIOs (XPT_CONT_TARGET_IO). If a CTIO is still outstanding when the 500 ms timer expires, targbhdtor calls kfree(softc) and returns into camperiphfree which frees periph->path and periph itself; the late CTIO completion then invokes targbhdone(periph, done_ccb) which dereferences periph->softc (line 522) — a use-after-free. The original author acknowledged this twice with XXX comments at lines 342 and 419.

Root cause

targbhdtor (scsi_targ_bh.c:402-424) sets state = TARGBH_STATE_TEARDOWN (line 409), calls targbhdislun (line 411), then unconditionally falls through to the default case (init_level == 1 after ctor line 397) which does sim_lock_sleep(softc, 0, "targbh", hz/2, periph->sim->lock) at line 420 followed by kfree(softc, M_SCSIBH) at line 421. A grep of the entire file confirms no wakeup(softc) anywhere, so the sleep always times out after exactly 500 ms.

targbhdislun (lines 329-382) aborts only accept_tio_list entries (lines 347-354, via XPT_ABORT on each ATIO) and immed_notify_slist entries (lines 356-363), then disables the LUN (lines 368-371). It never enumerates or aborts CTIOs that were submitted via xpt_action in targbhstart (line 497). The comment at line 342 (XXX Block for Continue I/O completion) and at line 419 (XXX Wait for callback of targbhdislun()) explicitly mark this as unfinished.

When a late CTIO completes, targbhdone (line 518) executes softc = (struct targbh_softc *)periph->softc (line 522) on freed memory. The XPT_CONT_TARGET_IO case (lines 638-695) further dereferences softc->pending_queue via TAILQ_REMOVE (line 648), softc->state (line 678), and calls targbhfreedescr / xpt_free_ccb (lines 692-693). camperiphfree (cam_periph.c:600-632) calls periph_dtor then immediately frees periph->path and periph itself, so by the time the late callback fires, both softc and periph are freed. The same class of race affects late XPT_IMMED_NOTIFY callbacks (line 705 path) and late XPT_ACCEPT_TARGET_IO abort callbacks (line 544 path), since targbhdone dereferences softc before checking the TEARDOWN / ABORTED status.

Threat model & preconditions

• Attacker position: A SCSI initiator with access to a target-mode bus served by this driver (physical SCSI, Fibre Channel, or iSCSI depending on the HBA/SIM).
• Privileges gained or impact: Practical impact is denial of service (kernel panic). Privilege escalation is theoretical: with slab grooming, the freed softc slab can be reclaimed with a controlled object enabling code execution via the corrupted TAILQ_REMOVE / function-pointer deref — but this is not demonstrated, hence the speculative confidence.
• Required config or capabilities: A target-mode-capable HBA/SIM with PIT_PROCESSOR (e.g. ahc/ahd in target mode, or the iSCSI target SIM). The scsi_targ_bh driver auto-attaches on any such LUN.
• Reachability: 1. Initiator sends a stream of INQUIRY CDBs to the targbh-served LUN to keep CTIOs in flight. 2. Stall the DATA IN phase of at least one CTIO by withholding transfer ACKs (on parallel SCSI this means holding off on REQ/ACK; on iSCSI, delaying the data-in PDU reception / sending a non-final R2T response). 3. Trigger SIM deregistration (AC_PATH_DEREGISTERED at targbhasync:214-221 triggers cam_periph_invalidate) — hot-plug removal, SIM fatal error, or admin action. 4. Within the 500 ms window after deregistration, the stalled CTIO must still be outstanding. targbhdtor sleeps 500 ms then kfrees softc. When the stalled CTIO finally completes (or the SIM abort-fires it), targbhdone dereferences freed softc → kernel panic in TAILQ_REMOVE or the periph->softc load.

Proof of concept

Reproduce the panic (DoS) path:

1. Use a SCSI target-mode-capable setup where this driver auto-attaches (any HBA with PIT_PROCESSOR, e.g. ahc/ahd in target mode, or the iSCSI target SIM).
2. From the initiator, send a stream of INQUIRY CDBs to the targbh-served LUN to keep CTIOs in flight.
3. Stall the DATA IN phase of at least one CTIO by withholding transfer ACKs (on parallel SCSI this means holding off on REQ/ACK; on iSCSI, delaying the data-in PDU reception / sending a non-final R2T response).
4. Trigger SIM deregistration — e.g. if using a hot-pluggable transport, disconnect the link; or use a separate fault-injection path (camcontrol to force a bus reset / LIP that the SIM treats as fatal).
5. Within the 500 ms window after deregistration, the stalled CTIO must still be outstanding.

For a QEMU-based PoC, a simpler trigger: load the targbh module on a target-mode SIM, start an initiator sending INQUIRYs, then unload / deregister the SIM while I/O is active and use a kernel delay-injection hook (or simply spam initiations) to hit the window.

Build & run

# No userspace binary needed — this is a kernel-internal driver auto-attach.
# Run inside a DragonFlyBSD guest with a target-mode-capable HBA emulated.
qemu-system-x86_64 -enable-kvm -m 1G \
    -device pvscsi,...  # or whichever HBA exposes target mode
    -hda dfbsd.img
# Inside the guest, ensure scsi_targ_bh loads; from the initiator host,
# issue a sustained INQUIRY stream and then trigger link/SIM deregistration.

Expected output

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x<address in freed M_SCSIBH slab>
targbhdone(...) at scsi_targ_bh.c:522   (or :648 TAILQ_REMOVE, :678 state check)
camperiphfree(...) at cam_periph.c:600
...
panic: from-rights-free

For a slab-corruption variant: panic: mp_free: mp is already free or panic: targbhdtor: multiple frees.

Impact

Local / network-adjacent DoS via kernel UAF during SCSI target-mode black-hole teardown. Speculative confidence — race window is narrow and depends on SIM / transport behavior. Medium severity per "kernel memory corruption" / "remote DoS on config" depending on the transport. This is a lower-severity analogue of the scsi_target.c teardown UAF class (DF-1045 lineage) — here there is no userland daemon to coordinate with, but the synchronization gap is the same shape: fixed sleep instead of a completion-wait on outstanding CTIOs.

Recommended fix

Replace the fixed hz/2 sleep with a proper outstanding-CTIO count + condition wait, OR explicitly abort all in-flight CTIOs before sleeping and wait on a wakeup that targbhdone's CTIO-completion path issues when the count reaches zero. Concretely:

• Add u_int outstanding_ctios; to targbh_softc.
• Increment in targbhstart before xpt_action (line 497); decrement in targbhdone XPT_CONT_TARGET_IO after xpt_release_ccb (line 677).
• In targbhdtor, loop with sim_lock_sleep waiting on a wakeup signal from targbhdone when outstanding_ctios == 0, with a generous safety timeout.

--- a/sys/bus/cam/scsi/scsi_targ_bh.c
+++ b/sys/bus/cam/scsi/scsi_targ_bh.c
@@ -84,6 +84,7 @@ struct targbh_softc {
    struct  tccb_queue pending_queue;
    struct  tccb_queue work_queue;
    struct  tccb_queue unknown_atio_queue;
+   u_int   outstanding_ctios;
    struct  tdevstat device_stats;
    targbh_state    state;
    targbh_flags    flags;
@@ -493,6 +494,8 @@ targbhstart(struct cam_periph *periph, union ccb *start_ccb)
        start_ccb->ccb_h.ccb_type = TARGBH_CCB_WORKQ;
        start_ccb->ccb_h.ccb_atio = atio;
+       softc->outstanding_ctios++;
+
        CAM_DEBUG(periph->path, CAM_DEBUG_SUBTRACE,
              ("Sending a CTIO\n"));
        xpt_action(start_ccb);
@@ -674,6 +677,11 @@ targbhdone(struct cam_periph *periph, union ccb *done_ccb)
        desc->data_resid -= desc->data_increment;

        xpt_release_ccb(done_ccb);
+       KKASSERT(softc->outstanding_ctios > 0);
+       if (--softc->outstanding_ctios == 0) {
+           /* Wake targbhdtor teardown wait */
+           wakeup(&softc->outstanding_ctios);
+       }

        if (softc->state != TARGBH_STATE_TEARDOWN) {
@@ -416,8 +424,14 @@ targbhdtor(struct cam_periph *periph)
        /* FALLTHROUGH */
    default:
-       /* XXX Wait for callback of targbhdislun() */
-       sim_lock_sleep(softc, 0, "targbh", hz/2, periph->sim->lock);
+       /*
+        * Wait for all in-flight CTIOs to complete.  targbhdone
+        * decrements outstanding_ctios and wakes us when it hits 0.
+        */
+       while (softc->outstanding_ctios > 0)
+           sim_lock_sleep(&softc->outstanding_ctios, 0, "targbh",
+                      hz, periph->sim->lock);
        kfree(softc, M_SCSIBH);

This replaces the unconditional fixed 500 ms timeout with a real completion-wait that blocks until every in-flight CTIO has called back, while still allowing a periodic (1 s) wakeup to re-check the condition and avoid indefinite hangs.

References

• DF-1045 — sibling finding (scsi_target.c teardown UAF class)
• sys/bus/cam/scsi/scsi_targ_bh.c:342, 419 — XXX comments acknowledging the unfinished synchronization
• sys/bus/cam/scsi/scsi_targ_bh.c:411 — targbhdislun does not abort CTIOs
• sys/bus/cam/scsi/scsi_targ_bh.c:420-421 — sim_lock_sleep + kfree(softc)
• sys/bus/cam/scsi/scsi_targ_bh.c:497 — xpt_action submits CTIOs that are not tracked
• sys/bus/cam/scsi/scsi_targ_bh.c:518-522 — targbhdone dereferences periph->softc
• sys/bus/cam/cam_periph.c:600-632 — camperiphfree frees periph after periph_dtor returns
• CWE-416 Use After Free

Timeline

• 2026-07-14 Discovered during automated audit.