• File: sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c
• Lines: 1289, 1290, 1293, 1301, 1302, 1303, 1304, 1305
• Severity: Low
• CVSS: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U:C:L/I:N/A:N
• CWE: CWE-200 Exposure of Sensitive Information
• Confidence: likely

Summary

hpt_ioctl kmallocs nOutBufferSize bytes (M_DEVBUF, no M_ZERO) for the outbuffer and then, on success, copyout()s the full nOutBufferSize to user space — not the count of bytes ldm actually wrote (which the OSM never learns).

A caller passing nOutBufferSize larger than the ioctl's required output size receives the unused tail of the kmalloc'd buffer, which contains stale M_DEVBUF heap contents (kernel pointers, file names, attacker-uncontrolled but sensitive data).

Root cause

• Line 1290: ioctl_args.lpOutBuffer = kmalloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK); — no M_ZERO flag, so the buffer starts out containing whatever was last freed into the M_DEVBUF slab.
• The closed-source ldm_ioctl writes only as many bytes as each dwIoControlCode requires (typically sizeof(CONTROLLER_INFO), sizeof(LOGICAL_DEVICE_INFO_V3), etc.).
• Lines 1302-1305: if (piop->nOutBufferSize) { if (copyout(ioctl_args.lpOutBuffer, (void*)piop->lpOutBuffer, piop->nOutBufferSize)) goto invalid; } copies the entire user-supplied size back, exposing the unwritten tail.

Threat

Caller is root (file mode 0600), but the leak crosses the kernel/user boundary for data the caller could not otherwise see — useful for KASLR bypass and for revealing recently-freed kernel object pointers when chained with heap-grooming primitives.

Each call leaks (nOutBufferSize - actual_size) bytes of heap.

Recommended fix

Zero the outbuffer on allocation, or copy out only the bytes ldm reports via lpBytesReturned (falling back to nOutBufferSize only when lpBytesReturned is unset).

--- a/sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c
+++ b/sys/dev/raid/hpt27xx/hpt27xx_osm_bsd.c
@@ -1289,7 +1289,8 @@ static int hpt_ioctl(struct dev_ioctl_args *ap)
        if (ioctl_args.nOutBufferSize) {
-           ioctl_args.lpOutBuffer = kmalloc(ioctl_args.nOutBufferSize, M_DEVBUF, M_WAITOK);
+           ioctl_args.lpOutBuffer = kmalloc(ioctl_args.nOutBufferSize,
+                           M_DEVBUF, M_WAITOK | M_ZERO);
            if (!ioctl_args.lpOutBuffer)
                goto invalid;
        }

And additionally cap the copyout to *lpBytesReturned when it is smaller than nOutBufferSize.