Summary

tw_cli_severity_string_table[] in tw_cl_misc.c:55-62 has only 6 entries (indices 0..5: "None", "ERROR", "WARNING", "INFO", "DEBUG", "").

The macro tw_cli_create_ctlr_event at tw_cl.h:319 computes severity = GET_SEVERITY((cmd_hdr)->status_block.res__severity) which masks a 3-bit field, producing a value in 0..7. When the firmware returns severity 6 or 7, tw_cli_severity_string_table[6/7] reads past the array. The resulting garbage pointer is then dereferenced as a string by tw_osl_strcpy(event->severity_str, severity_str) at tw_cl_misc.c:529.

Root cause

tw_cl_misc.c:55-62 defines exactly 6 entries:

TW_INT8 *tw_cli_severity_string_table[] = {
    "None", "ERROR", "WARNING", "INFO", "DEBUG", ""
};

GET_SEVERITY in tw_cl_fwif.h:423-424 is (res__severity & 0x7) → domain is {0,1,2,3,4,5,6,7}. Only the values used by kernel-internal callers (TW_CL_SEVERITY_ERROR=0x1 through TW_CL_SEVERITY_DEBUG=0x4) and 0 are covered; values 6 and 7 have no table entry.

The macro tw_cli_create_ctlr_event at tw_cl.h:319-322 then indexes the table without clamping:

tw_cli_severity_string_table[severity]

The pointer fetched from index 6 or 7 is whatever happens to follow the table in .data (likely a function pointer or other symbol); it is then passed as severity_str to tw_cl_create_event and dereferenced byte-by-byte by tw_osl_strcpy(event->severity_str, severity_str) at tw_cl_misc.c:529.

If the dereferenced address is unmapped → kernel page fault (panic). If mapped → the read bytes are written into severity_str[20] unbounded (strcpy), giving a second overflow primitive independent of DF-1664.

Threat model

Attacker position is the controller firmware (or any PCIe-level attacker that can synthesize AEN sense data: malicious/emulated device, vfio-pci MitM, hostile Thunderbolt peripheral). Required precondition: device is detected by the twa driver at attach.

Reachability: the AEN default-case at tw_cl_intr.c:702-710 invokes tw_cli_create_ctlr_event with the firmware-controlled cmd_hdr; severity bits come directly from cmd_hdr->status_block.res__severity.

Impact is primarily denial of service (kernel panic on unmapped dereference). In the rarer case where the OOB-read pointer happens to land on mapped memory, it becomes an info leak into severity_str (20 bytes) and a secondary overflow source feeding into DF-1664.

PoC

Reproducer requires the same sense-data injection harness as DF-1664 (B).

1. Cause the controller to deliver an AEN whose sense buffer has cmd_hdr.status_block.res__severity set to 0x06 or 0x07 in its low 3 bits (e.g. byte value 0x06, 0x07, 0x0E, 0x0F, 0x16, ...).
2. Wait for tw_cli_manage_aen default case → tw_cli_create_ctlr_event → tw_cli_severity_string_table[6 or 7].
3. Success criterion: kernel panic with a page-fault-on-dereference at tw_cl_misc.c:529 (strcpy of the OOB-read pointer), or KASAN/ASAN reporting an OOB read at tw_cl_misc.c:55 (table) consumed at tw_cl.h:322.

Recommended fix

Either clamp severity to the table domain, or extend the table. Clamping in the macro is the smaller change:

--- a/sys/dev/raid/twa/tw_cl.h
+++ b/sys/dev/raid/twa/tw_cl.h
@@ -317,6 +317,8 @@
 #define tw_cli_create_ctlr_event(ctlr, event_src, cmd_hdr) do {    \
    TW_UINT8 severity =                     \
        GET_SEVERITY((cmd_hdr)->status_block.res__severity);    \
+   if (severity >= nitems(tw_cli_severity_string_table))       \
+       severity = 0;                       \
    tw_cl_create_event(ctlr->ctlr_handle, TW_CL_TRUE, event_src,    \
        (cmd_hdr)->status_block.error,              \
        severity,                       \

Alternatively, append two NULL entries to tw_cli_severity_string_table in tw_cl_misc.c:55-62 so all 8 possible 3-bit values are in-domain. The clamp is preferred because it also defends against any future shrink of the table.

Related findings

• DF-1664 (sibling: same driver, unbounded vsprintf/strcpy overflow in the same event path)