24XX target-mode ATIO7 with unrecognized TMF flags or unmatched D_ID leaks FCP exchange
Summary
isp_target_notify at isp_target.c:186-188: dispatches to isp_got_tmf_24xx then break. isp_got_tmf_24xx: D_ID miss (:989-992) returns without ack/endcmd. Unrecognized TMF (:1013-1016) sets NT_UNKNOWN returns before isp_async. at_rxid exchange never completed. Every other path in file acks or terminates. Remote FC initiator injects reserved TMF bits -> firmware exchange table exhaustion -> target-mode DoS. Fix: call isp_endcmd(ECMD_TERMINATE) on both early-return paths.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1448 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 986 B | ↓ raw |
DF-1448 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
24XX target-mode ATIO7 with unrecognized TMF flags or unmatched D_ID leaks FCP exchange
Source Location
sys/dev/disk/isp/isp_target.c:187-1016
Verdict
Source-confirmed (complex fix): 24XX target-mode ATIO7 with unrecognized TMF flags or unmatched D_ID l. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
isp_target_notify at isp_target.c:186-188: dispatches to isp_got_tmf_24xx then break. isp_got_tmf_24xx: D_ID miss (:989-992) returns without ack/endcmd. Unrecognized TMF (:1013-1016) sets NT_UNKNOWN returns before isp_async. at_rxid exchange never completed. Every other path in file acks or terminates. Remote FC initiator injects reserved TMF bits -> firmware exchange table exhaustion -> target-mode DoS. Fix: call isp_endcmd(ECMD_TERMINATE) on both early-return paths.
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: isp_target 24XX ATIO7 with unrecognized TMF flags or unmatched D_ID does not release FCP exchange, resource leak. Complex fix. HW-gated.
Verified recommended fix
Source-confirmed: isp_target 24XX ATIO7 with unrecognized TMF flags or unmatched D_ID does not release FCP exchange, resource leak. Complex fix. HW-gated.
Verdict
Source-confirmed: isp_target 24XX ATIO7 with unrecognized TMF flags or unmatched D_ID does not release FCP exchange, resource leak. Complex fix. HW-gated.
No comments yet.