DF-1109 — I2C I2CRDWR ioctl TOCTOU double-fetch of d->nmsgs

Verdict (this run)

SOURCE-CONFIRMED, NOT REPRODUCED AT RUNTIME on this guest — the six-fold re-fetch of d->nmsgs from user memory is traced line-by-line in compiled module source (iic.ko ships in /boot/kernel), but the I2C driver never attaches here (no i2c controller, no /dev/iic*). The fix (fix.diff) applies and compiles (iic.ko rebuilt clean under -Werror).

Additional finding-derived caveat: /dev/iicN is created mode 0600 root:wheel (iic.c:129), so the bug is root→kernel (no unprivileged boundary crossing); realistic impact is a root-driven TOCTOU heap overflow plus an OOM DoS (nmsgs=UINT32_MAX → ~24 GB M_WAITOK allocation).

How to reproduce (HW-equipped host, as root)

1. ./build.sh && ./run.sh /dev/iic0 — two threads: one issues ioctl(I2CRDWR) in a loop, the other flips nmsgs between the allocation size and an overflow size so a bump lands between the kmalloc and the copyin/loops. A successful race overflows buf (16 B/excess) / usrbufs (8 B/excess).
2. Requires: an i2c controller so /dev/iic0 exists, and root to open it.

Why not on this guest

No i2c controller hardware; iic.ko not loaded; no /dev/iic*. The trigger cannot open() a device. Dormant code path, not absent.

Files

• poc_iic_toctou.c — intended racing-threads trigger (documented).
• fix.diff — snapshot nmsgs into a local once, cap at 65536, use local everywhere.
• iic_fix_build.log — proof the fix compiles (-Werror, rc=0).
• VERDICT.md — full line-by-line trace.

DF-1109 — VERDICT

Verdict

SOURCE-CONFIRMED (real bug), NOT REPRODUCED AT RUNTIME on this guest. The TOCTOU double-fetch of d->nmsgs is traced line-by-line in compiled module source. It does not fire here because the I2C driver never attaches (no i2c controller, no /dev/iic*). Dormant code path, not a false positive (iic.ko ships in /boot/kernel). Additional reachability caveat: even with HW, the device node is 0600 root:wheel so the bug is root→kernel (no unprivileged boundary crossing).

Mechanism (source trace)

1. iicioctl (sys/bus/iicbus/iic.c:291) casts data = ap->a_data — the raw user ioctl-data pointer; the kernel does not copyin ioctl structs for drivers (device.h:114 a_data is caddr_t user pointer).
2. case I2CRDWR: (iic.c:~347-369) dereferences d->nmsgs from user memory at six separate points: - :348 buf = kmalloc(sizeof(*d->msgs) * d->nmsgs, ...) reads N1 - :349 usrbufs = kmalloc(sizeof(void*) * d->nmsgs, ...) reads N1 - :350 copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs) reads N2 - :354 for (i = 0; i < d->nmsgs; i++) reads N3 - :361 iicbus_transfer(parent, buf, d->nmsgs) reads N4 - :363 for (i = 0; i < d->nmsgs; i++) reads N5
3. The intervening kmalloc(M_WAITOK) calls sleep, widening the race window. A racing thread that bumps nmsgs after the allocation (small N1) but before the copyin/loops (large N2..N5) overflows buf (16 B/excess entry — struct iic_msg = slave/len/buf) and usrbufs (8 B/excess entry).
4. The overflowed m->buf/m->len/m->flags are then read from adjacent heap and used as a kmalloc size and copyin/copyout arguments → controlled heap corruption / info leak.
5. Secondary DoS: nmsgs = UINT32_MAX requests ~24 GB M_WAITOK allocations (16 * UINT32_MAX and 8 * UINT32_MAX) → OOM.

Reachability / privilege caveat

/dev/iicN is created mode 0600 UID_ROOT GID_WHEEL (iic.c:129). Opening it requires root. The bug is therefore a root→kernel TOCTOU (root corrupting its own kernel) — no privilege boundary is crossed. This is a valid hard blocker for any uid=0 claim: there is no unprivileged path to the write.

Why not reproduced here

No i2c controller HW; iic.ko not loaded; /dev/iic* absent. Trigger cannot open() a device.

Fix

fix.diff snapshots d->nmsgs once into a local uint32_t nmsgs, caps it at 65536 (kills the OOM DoS and bounds the allocation), and uses the local at every subsequent site (both kmallocs, copyin, both loops, transfer). Supersedes the finding's proposal (which described the snapshot but did not bound nmsgs).

Fix validation (compile)

Applies (git apply --check clean) and compiles: iic.ko rebuilt from patched source under -Werror, iic.c compiled clean, rc=0. Runtime before/after is not_testable (no HW; and even with HW the path is root-only, so no unprivileged escalation to validate).

Exploit chain

None — the primitive is root-reachable only (no privilege boundary crossed), and unreachable at runtime on this guest regardless.