MPS_FLAGS_BUSY never cleared on invalid-direction early return permanently locks ioctls
Summary
mps_user_pass_thru at mps_user.c:765: sc->mps_flags|=MPS_FLAGS_BUSY. Invalid direction branch at :790 return(EINVAL) skips Ret: label at :1048 that clears flag. Single malformed call -> BUSY set forever -> all passthru and diag_action ioctls return EBUSY until reboot. Operator group. Fix: goto Ret instead of return.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1363 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 829 B | ↓ raw |
DF-1363 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
MPS_FLAGS_BUSY never cleared on invalid-direction early return permanently locks ioctls
Source Location
sys/dev/raid/mps/mps_user.c:765-790
Verdict
Source-confirmed (complex fix): MPS_FLAGS_BUSY never cleared on invalid-direction early return permane. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
mps_user_pass_thru at mps_user.c:765: sc->mps_flags|=MPS_FLAGS_BUSY. Invalid direction branch at :790 return(EINVAL) skips Ret: label at :1048 that clears flag. Single malformed call -> BUSY set forever -> all passthru and diag_action ioctls return EBUSY until reboot. Operator group. Fix: goto Ret instead of return.
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: mps_user sc->mps_flags|=MPS_FLAGS_BUSY never cleared on invalid-direction early return, permanently locks ioctls. Complex fix (needs lock reorder). HW-gated.
Verified recommended fix
Source-confirmed: mps_user sc->mps_flags|=MPS_FLAGS_BUSY never cleared on invalid-direction early return, permanently locks ioctls. Complex fix (needs lock reorder). HW-gated.
Verdict
Source-confirmed: mps_user sc->mps_flags|=MPS_FLAGS_BUSY never cleared on invalid-direction early return, permanently locks ioctls. Complex fix (needs lock reorder). HW-gated.
No comments yet.