Missing NULL check after ahci_ata_get_xfer in disk_io and atapi_io dispatch (defense-in-depth)
Summary
ahci_xpt_scsi_disk_io :1082 and ahci_xpt_scsi_atapi_io :1524: xa=ahci_ata_get_xfer() may return NULL on CCB pool exhaustion. No NULL check before xa->fis deref. CAM throttling prevents exhaustion in practice (sc_ncmds-1 devq). Latent defense-in-depth. Fix: add if(xa==NULL){CAM_REQUEUE_REQ;xpt_done;return;}.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1444 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 849 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 720 B | view raw |
DF-1444 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: speculative
Finding
Missing NULL check after ahci_ata_get_xfer in disk_io and atapi_io dispatch (defense-in-depth)
Source Location
sys/dev/disk/ahci/ahci_cam.c:1082-1524
Verdict
Source-confirmed: Missing NULL check after ahci_ata_get_xfer in disk_io and atapi_io dis. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
ahci_xpt_scsi_disk_io :1082 and ahci_xpt_scsi_atapi_io :1524: xa=ahci_ata_get_xfer() may return NULL on CCB pool exhaustion. No NULL check before xa->fis deref. CAM throttling prevents exhaustion in practice (sc_ncmds-1 devq). Latent defense-in-depth. Fix: add if(xa==NULL){CAM_REQUEUE_REQ;xpt_done;return;}.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: ahci_cam disk_io/atapi_io missing NULL check after ahci_ata_get_xfer (defense-in-depth). Added NULL check with CAM_REQ_CMP_ERR. HW-gated.
Verified recommended fix
Source-confirmed: ahci_cam disk_io/atapi_io missing NULL check after ahci_ata_get_xfer (defense-in-depth). Added NULL check with CAM_REQ_CMP_ERR. HW-gated.
Verdict
Source-confirmed: ahci_cam disk_io/atapi_io missing NULL check after ahci_ata_get_xfer (defense-in-depth). Added NULL check with CAM_REQ_CMP_ERR. HW-gated.
No comments yet.