dpt_intr exits entire ISR on one bogus status packet (return should be continue)
Summary
dpt_intr at dpt_scsi.c:1522: ccb_busaddr OOB check -> return (exits entire while(HA_AIRQ) loop). Should be continue. One bogus packet from malicious/buggy HBA -> all subsequent completions lost -> controller hang. Fix: return -> continue.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1465 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 759 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 775 B | view raw |
DF-1465 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
dpt_intr exits entire ISR on one bogus status packet (return should be continue)
Source Location
sys/dev/raid/dpt/dpt_scsi.c:1518-1522
Verdict
Source-confirmed: dpt_intr exits entire ISR on one bogus status packet (return should be. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
dpt_intr at dpt_scsi.c:1522: ccb_busaddr OOB check -> return (exits entire while(HA_AIRQ) loop). Should be continue. One bogus packet from malicious/buggy HBA -> all subsequent completions lost -> controller hang. Fix: return -> continue.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: dpt_intr exits entire ISR on one bogus status packet (return should be continue), starving pending commands. Fixed return to continue. HW-gated.
Verified recommended fix
Source-confirmed: dpt_intr exits entire ISR on one bogus status packet (return should be continue), starving pending commands. Fixed return to continue. HW-gated.
Verdict
Source-confirmed: dpt_intr exits entire ISR on one bogus status packet (return should be continue), starving pending commands. Fixed return to continue. HW-gated.
No comments yet.