Unchecked csio->cdb_len bcopy overflows 32-byte CDB32 in SCSI IO request frame
Summary
mpssas_action_scsiio at mps_sas.c:1685-1689: bcopy(csio->cdb_io.cdb_ptr/cdb_bytes,&req->CDB.CDB32[0],csio->cdb_len). cdb_len is u8 (0-255), CDB32 is 32 bytes at offset 0x40 of MPI2_SCSI_IO_REQUEST. cdb_len>32 -> 223B overflow into inline SGL and rest of per-command DMA request frame. CAM_CDB_POINTER path also derefs user ptr without copyin -> kernel panic on unmapped page. cdb_bytes path reads past 16-byte union. Impact bounded: SGL re-init overwrites corrupted area before firmware read. Sibling of DF-1235 (trm CDB overflow). Fix: check cdb_len<=32, use copyin for cdb_ptr.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1270 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1018 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 583 B | view raw |
DF-1270 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
Unchecked csio->cdb_len bcopy overflows 32-byte CDB32 in SCSI IO request frame
Source Location
sys/dev/raid/mps/mps_sas.c:1685-1689
Verdict
Source-confirmed: Unchecked csio->cdb_len bcopy overflows 32-byte CDB32 in SCSI IO reque. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
mpssas_action_scsiio at mps_sas.c:1685-1689: bcopy(csio->cdb_io.cdb_ptr/cdb_bytes,&req->CDB.CDB32[0],csio->cdb_len). cdb_len is u8 (0-255), CDB32 is 32 bytes at offset 0x40 of MPI2_SCSI_IO_REQUEST. cdb_len>32 -> 223B overflow into inline SGL and rest of per-command DMA request frame. CAM_CDB_POINTER path also derefs user ptr without copyin -> kernel panic on unmapped page. cdb_bytes path reads past 16-byte union. Impact bounded: SGL re-init overwrites corrupted area before firmware read. Sibling
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: mps_sas bcopy of csio->cdb_len into CDB32[32] without bound; cdb_len can exceed sizeof(CDB32). Added imin() bound. HW-gated.
Verified recommended fix
Source-confirmed: mps_sas bcopy of csio->cdb_len into CDB32[32] without bound; cdb_len can exceed sizeof(CDB32). Added imin() bound. HW-gated.
Verdict
Source-confirmed: mps_sas bcopy of csio->cdb_len into CDB32[32] without bound; cdb_len can exceed sizeof(CDB32). Added imin() bound. HW-gated.
No comments yet.