SGE scatter/gather table bounds mismatch allows latent OOB write in sili_load_prb_callback
Summary
sili_load_prb_callback at sili.c:1245: KKASSERT(nsegs<=SILI_MAX_SGET=124) but SGE layout inserts link entry at every 4th slot (sgi&3)==3, only 3/4 hold data. Safe bound is SILI_MAX_SGET*3/4=93. DMA tag maxsegs=124 at sili_attach.c:235. KKASSERT compiled out in production. nsegs>=94 -> prb_sge OOB write. Currently gated by CAM maxio=256KB (max 64 segs). Latent: becomes exploitable if SILI_MAXPHYS raised. sili.h:644 compile-time check already uses 3/4 ratio. Fix: change maxsegs to SILI_MAX_SGET*3/4.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1338 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 605 B | view raw |
DF-1338 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
SGE scatter/gather table bounds mismatch allows latent OOB write in sili_load_prb_callback
Source Location
sys/dev/disk/sili/sili.c:1245-1267
Verdict
Source-confirmed: SGE scatter/gather table bounds mismatch allows latent OOB write in si. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
sili_load_prb_callback at sili.c:1245: KKASSERT(nsegs<=SILI_MAX_SGET=124) but SGE layout inserts link entry at every 4th slot (sgi&3)==3, only 3/4 hold data. Safe bound is SILI_MAX_SGET3/4=93. DMA tag maxsegs=124 at sili_attach.c:235. KKASSERT compiled out in production. nsegs>=94 -> prb_sge OOB write. Currently gated by CAM maxio=256KB (max 64 segs). Latent: becomes exploitable if SILI_MAXPHYS raised. sili.h:644 compile-time check already uses 3/4 ratio. Fix: change maxsegs to SILI_MAX_SGET3/
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: sili_load_prb_callback SGE scatter/gather table bounds mismatch with link entries allows latent OOB write. Added nsegs clamp after KKASSERT. HW-gated.
Verified recommended fix
Source-confirmed: sili_load_prb_callback SGE scatter/gather table bounds mismatch with link entries allows latent OOB write. Added nsegs clamp after KKASSERT. HW-gated.
Verdict
Source-confirmed: sili_load_prb_callback SGE scatter/gather table bounds mismatch with link entries allows latent OOB write. Added nsegs clamp after KKASSERT. HW-gated.
No comments yet.