isp_pci_mbxdma error cleanup frees DMA through stale base pointer on FC adapters
Summary
isp_pci_mbxdma at isp_pci.c:1629: FC loop bus_dmamem_alloc overwrites local base each iteration. bad: cleanup at :1670/1673 frees using stale base for ALL channels AND control area. Correct per-channel base in FCPARAM->isp_scratch. bus_dmamem_free with wrong KVA -> UAF/wrong-free. Requires FC adapter + DMA alloc failure under memory pressure. Fix: save cbase before FC loop, use FCPARAM->isp_scratch per channel.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1422 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 919 B | ↓ raw |
DF-1422 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
isp_pci_mbxdma error cleanup frees DMA through stale base pointer on FC adapters
Source Location
sys/dev/disk/isp/isp_pci.c:1629-1673
Verdict
Source-confirmed (complex fix): isp_pci_mbxdma error cleanup frees DMA through stale base pointer on F. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
isp_pci_mbxdma at isp_pci.c:1629: FC loop bus_dmamem_alloc overwrites local base each iteration. bad: cleanup at :1670/1673 frees using stale base for ALL channels AND control area. Correct per-channel base in FCPARAM->isp_scratch. bus_dmamem_free with wrong KVA -> UAF/wrong-free. Requires FC adapter + DMA alloc failure under memory pressure. Fix: save cbase before FC loop, use FCPARAM->isp_scratch per channel.
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: isp_pci_mbxdma error cleanup frees DMA through stale base variable shared across loop iterations on FC adapters, double-free/UAF. Complex fix. HW-gated.
Verified recommended fix
Source-confirmed: isp_pci_mbxdma error cleanup frees DMA through stale base variable shared across loop iterations on FC adapters, double-free/UAF. Complex fix. HW-gated.
Verdict
Source-confirmed: isp_pci_mbxdma error cleanup frees DMA through stale base variable shared across loop iterations on FC adapters, double-free/UAF. Complex fix. HW-gated.
No comments yet.