MPS_FLAGS_BUSY never cleared on invalid-direction early return permanently locks ioctls
Summary
mps_user_pass_thru at mps_user.c:765: sc->mps_flags|=MPS_FLAGS_BUSY. Invalid direction branch at :790 return(EINVAL) skips Ret: label at :1048 that clears flag. Single malformed call -> BUSY set forever -> all passthru and diag_action ioctls return EBUSY until reboot. Operator group. Fix: goto Ret instead of return.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1363 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.2 KB | ↓ raw |
DF-1363 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
MPS_FLAGS_BUSY never cleared on invalid-direction early return permanently locks ioctls
Source Location
sys/dev/raid/mps/mps_user.c:765-790
Verdict
Source-confirmed (complex fix): MPS_FLAGS_BUSY never cleared on invalid-direction early return permane. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
mps_user_pass_thru at mps_user.c:765: sc->mps_flags|=MPS_FLAGS_BUSY. Invalid direction branch at :790 return(EINVAL) skips Ret: label at :1048 that clears flag. Single malformed call -> BUSY set forever -> all passthru and diag_action ioctls return EBUSY until reboot. Operator group. Fix: goto Ret instead of return.
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
(No fix.diff for this item: documented recommendation only - see Fix above.)
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: mps_user sc->mps_flags|=MPS_FLAGS_BUSY never cleared on invalid-direction early return, permanently locks ioctls. Complex fix (needs lock reorder). HW-gated.
Verified recommended fix
Source-confirmed: mps_user sc->mps_flags|=MPS_FLAGS_BUSY never cleared on invalid-direction early return, permanently locks ioctls. Complex fix (needs lock reorder). HW-gated.
Verdict
Source-confirmed: mps_user sc->mps_flags|=MPS_FLAGS_BUSY never cleared on invalid-direction early return, permanently locks ioctls. Complex fix (needs lock reorder). HW-gated.
No comments yet.