• File: sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c
• Lines: 715, 717, 724, 728, 479, 488
• Severity: High
• CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U:C:H/I:H/A:H
• CWE: CWE-787 Out-of-bounds Write
• Confidence: certain

Summary

hpt_scsi_io copies ccb->csio.sglist_cnt scatter/gather entries from a caller-supplied list into pCmd->psg without any bounds check.

pCmd->psg aliases ext->psg, a fixed array of os_max_sg_descriptors (==18) SG entries (os_bsd.h:155, osm.h:40).

Since sglist_cnt is a u_int16_t (cam_ccb.h:604) reaching up to 65535, a caller-supplied CCB with sglist_cnt > 18 writes attacker-controlled 16-byte SG records (size/eot/addr) past the end of the OS_CMDEXT structure into adjacent kernel heap.

The same unbounded loop is duplicated in os_buildsgl (lines 479-488).

This is the same bug class as DF-1311 (hptiop) and DF-1529-1531 (hptmv).

Root cause

At hpt27xx_osm_bsd.c:715 pCmd->psg = ext->psg; aliases the command's S/G pointer to a fixed 18-entry array declared in os_bsd.h:155 as SG psg[os_max_sg_descriptors]; with os_max_sg_descriptors==18 (osm.h:40).

The loop at lines 724-728:

for (idx = 0; idx < ccb->csio.sglist_cnt; idx++) {
    pCmd->psg[idx].addr.bus = sgList[idx].ds_addr;
    pCmd->psg[idx].size = sgList[idx].ds_len;
    pCmd->psg[idx].eot = ...;
}

uses the CCB's sglist_cnt (u_int16_t per cam_ccb.h:604) as the only bound.

No comparison to os_max_sg_descriptors (or to the dma tag's nsegments=18 set at line 1047) exists anywhere on the CAM_SCATTER_VALID path.

sizeof(SG)=16 on 64-bit (him.h:281-290: HPT_U32 size + pad + HPT_UINT eot + 8-byte addr union), so sglist_cnt=N>18 overflows by (N-18)*16 bytes.

psg is the LAST field of OS_CMDEXT, so the overflow runs straight into whatever follows in M_DEVBUF.

os_buildsgl() at lines 479-488 has the identical defect against the same ext->psg alias when called by LDM with logical=TRUE.

Threat

Attacker must be able to issue a CAM pass-through CCB to an hpt27xx-managed target id (0..osm_max_targets-1).

On DragonFly this requires opening /dev/passN which is created mode 0600 root (scsi_pass.c:279-280), so the live trigger is a privileged user — but this is exactly the trust boundary that protects kernel heap integrity (root inside a jail, defense-in-depth against privileged-but-untrusted code, and any future relaxation of devfs rules).

With a malicious CCB the attacker obtains an arbitrary-length, fully attacker-controlled 16-byte-aligned overwrite of kernel heap immediately following an OS_CMDEXT object (allocated in batches of os_max_queue_comm==32 at lines 1055-1069, so the next allocation is typically another OS_CMDEXT — corrupting its vbus_ext/next/ccb/dma_map/psg fields).

Impact ranges from trivial DoS (panic on corrupted freelist or invalid ext->ccb deref in os_cmddone at line 424) to kernel arbitrary write / code execution if the heap is groomed so the overwrite lands on a victim object containing a function pointer or pointer-to-function dereference (e.g., the done/buildsgl/target fields of a PCOMMAND).

Recommended fix

Validate ccb->csio.sglist_cnt against os_max_sg_descriptors before the loop. Apply at both the inline copy site in hpt_scsi_io and the helper os_buildsgl:

--- a/sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c
+++ b/sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c
@@ -714,6 +714,13 @@ static void hpt_scsi_io(PVBUS_EXT vbus_ext, union ccb *ccb)

        if (ccb->ccb_h.flags & CAM_SCATTER_VALID) {
            int idx;
+           if (ccb->csio.sglist_cnt == 0 ||
+               ccb->csio.sglist_cnt > os_max_sg_descriptors) {
+               cmdext_put(ext);
+               ldm_free_cmds(pCmd);
+               ccb->ccb_h.status = CAM_REQ_INVALID;
+               xpt_done(ccb);
+               return;
+           }
            bus_dma_segment_t *sgList = (bus_dma_segment_t *)ccb->csio.data_ptr;

            if (ccb->ccb_h.flags & CAM_SG_LIST_PHYS)
@@ -478,6 +485,11 @@ static int os_buildsgl(PCOMMAND pCmd, PSG pSg, int logical)
            if (ccb->ccb_h.flags & CAM_SG_LIST_PHYS)
                panic("physical address unsupported");

+           if (ccb->csio.sglist_cnt > os_max_sg_descriptors)
+               return FALSE;
+
            for (idx = 0; idx < ccb->csio.sglist_cnt; idx++) {
                os_set_sgptr(&pSg[idx], (HPT_U8 *)(HPT_UPTR)sgList[idx].ds_addr);

The proper long-term fix is to publish os_max_sg_descriptors (or a new maxsg field) via XPT_PATH_INQ so CAM enforces it at the periph layer, but the SIM must not rely on that alone.

Related findings

• DF-1311 (twin, hptiop): unbounded SG list stack overflow.
• DF-1529-1531 (siblings, hptmv): HPT GUI ioctl family.
• DF-1487 (twin, if_wb): TX fragment array OOB.