• File: sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c
• Lines: 1260, 1273, 1278, 1301, 1307, 1308, 1310
• Severity: Low
• CVSS: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:L/I:N/A:N
• CWE: CWE-908 Use of Uninitialized Resource
• Confidence: likely

Summary

hpt_ioctl declares HPT_U32 bytesReturned; on the stack with no initializer, hands &bytesReturned to ldm_ioctl via lpBytesReturned, and then unconditionally copyout()s it to user space whenever result==HPT_IOCTL_RESULT_OK and the caller provides lpBytesReturned.

memset(&ioctl_args, 0, ...) at line 1273 zeroes the IOCTL_ARG but does not touch bytesReturned.

Any ioctl code in the closed-source ldm blob that returns OK without writing *lpBytesReturned leaks 4 bytes of uninitialized kernel stack to user space.

Root cause

• Line 1260: HPT_U32 bytesReturned; — no initializer.
• Line 1273: memset(&ioctl_args, 0, sizeof(ioctl_args)); zeroes only ioctl_args, not bytesReturned.
• Line 1278: ioctl_args.lpBytesReturned = &bytesReturned;.
• Lines 1307-1310: if (piop->lpBytesReturned) { if (copyout(&bytesReturned, (void*)piop->lpBytesReturned, sizeof(HPT_U32))) goto invalid; } — executes whenever result==HPT_IOCTL_RESULT_OK (line 1301).

Since ldm is shipped as opaque object code (Makefile line 7-13, x86_64-elf.hpt27xx_lib.o.uu), we cannot prove which ioctl codes fail to set *lpBytesReturned, but the contract is unsafe: the OSM trusts the blob to always write the field on success.

Threat

Caller is root (file is mode 0600).

The leaked 4 bytes come from the kernel stack frame active just before the call; typical contents are previously-pushed return addresses or saved registers, enabling KASLR offset inference or assisting exploitation of a separate kernel info leak / memory corruption bug.

Severity is bounded by 4 bytes per call and by the already-root precondition.

Recommended fix

Initialize bytesReturned to 0 at declaration.

--- a/sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c
+++ b/sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c
@@ -1257,7 +1257,7 @@ static int hpt_ioctl(struct dev_ioctl_args *ap)
    u_long cmd = ap->a_cmd;
    caddr_t data = ap->a_data;
    PHPT_IOCTL_PARAM piop=(PHPT_IOCTL_PARAM)data;
    IOCTL_ARG ioctl_args;
-   HPT_U32 bytesReturned;
+   HPT_U32 bytesReturned = 0;

    switch (cmd){