DF-1238 — trm_Reselect circular DCB ring (infinite loop / DoS)

Verdict: NOT REPRODUCED (dead code at runtime — no hardware)

Mechanism (source-level, confirmed real)

trm_Reselect() at sys/dev/disk/trm/trm.c:2411 handles SCSI target reselection. After reading the reselected target/LUN id at line 2426:

RselTarLunId = trm_reg_read16(TRMREG_SCSI_TARGETID) & 0x1FFF;
pDCB = pACB->pLinkDCB;
while (RselTarLunId != *((u_int16_t *) &pDCB->TargetID)) {
    pDCB = pDCB->pNextDCB;
}

The DCB list is circular: in trm_initDCB() (line 2893-2911) the first node's pNextDCB points to itself, and each subsequent node is inserted so the tail links back to pLinkDCB. So if RselTarLunId matches no DCB (e.g. a malicious/misbehaving SCSI target reselects with a fabricated target/LUN), this while loop has no termination and spins forever in the interrupt handler context, freezing the system (hard hang, requires power cycle).

The bounded-walk pattern is already used elsewhere in the same file at lines 2301-2311 (for (i = 0; i < cnt; i++) using pACB->DeviceCnt), confirming the author intended bounded iteration.

The bug is real in source. A malicious SCSI target that reselects with an ID/LUN not matching any known DCB causes an unbounded loop in interrupt context.

Why it cannot reproduce on this guest

trm is the Tekram DC395U/UW/F SCSI host-bus-adapter driver.

• NOT in X86_64_GENERIC: only in LINT64 (sys/config/LINT64).
• Available as a loadable module trm.ko, but not loaded on the guest (kldstat shows only ehci.ko, xhci.ko).
• The QEMU guest has no SCSI HBA at all — pciconf -l shows only 440FX/PIIX3/PIIX4 bridges, VGA, virtio-net, virtio-blk.
• Even if kldload trm were run (requires root), the driver's trm_probe would find no Tekram PCI device and never attach → no interrupt → no reselection path → unreachable.

This is valid hard blocker: dead/unreachable at runtime on this guest (no hardware). The threat model is a malicious SCSI peripheral on a real system with a Tekram DC395U controller.

Fix

fix.diff bounds the DCB walk by pACB->DeviceCnt iterations and, on no-match, aborts via TmpSRB (consistent with the existing unexpected- reselection abort at lines 2439-2446). Compiled successfully as trm.ko.

Impact

• On this guest: none (dead code, no hardware).
• On a real system: unprivileged local DoS / system freeze requiring power cycle, triggered by a malicious SCSI target reselecting with a bogus ID/LUN. No local privilege needed by the attacker — the attack surface is a malicious peripheral.