tws_attach arms IRQ and publishes /dev/tws<unit> before sc->reqs allocated -> NULL-deref panic
Summary
tws_attach ordering: line 197-200 lockinit; 202 init_trace_q; 268 tws_setup_irq -> bus_setup_intr(432) makes tws_intr LIVE; 284 make_dev publishes /dev/tws0; 287 si_drv1=sc; 289 tws_init -> 535 sc->reqs=kmalloc M_ZERO FIRST non-NULL; 537 sense_bufs; 547 tws_turn_off_interrupts. Window 268/284..535: sc->reqs==NULL but IRQ armed + cdev openable. tws_get_request (745): case PASSTHRU r=&sc->reqs[2] then r->state deref -> NULL+offset page fault panic. Same for indices 0/1/3 at 752/762/782. IRQ path tws_intr (tws_cam.c:1104) reads HISTAT; controller signals in window -> tws_intr_resp executes sc->reqs[req_id].cb(&sc->reqs[req_id]) (tws_cam.c:1170). EBUSY guard only checks TWS_RESET not TWS_INIT. Page 0 unmapped DFly so panic not RCE. Root required (mode 0600). Fix: make_dev/bus_setup_intr after tws_init completes.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1731 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Move tws_setup_irq call to after tws_init completes. | 918 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1731 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/raid/tws/tws.c:268,284,289.
Mechanism
tws_attach arms IRQ (tws_setup_irq) and publishes /dev/tws0 (make_dev) before tws_init allocates sc->reqs; in the window an IRQ or open derefs sc->reqs[req_id] which is NULL.
Fix
Move tws_setup_irq call to after tws_init completes.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
tws.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- r
- a
- i
- d
- /
- t
- w
- s
- /
- t
- w
- s
- .
- c
- :
- 2
- 6
- 8
- s
- y
- s
- /
- d
- e
- v
- /
- r
- a
- i
- d
- /
- t
- w
- s
- /
- t
- w
- s
- .
- c
- :
- 2
- 8
- 9
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/raid/tws/tws.c:268,289. Fix compiled clean.
PoC changes
authored fix.diff: move tws_setup_irq after tws_init
Verified recommended fix
Move IRQ setup to after tws_init completes. Matches finding proposal.
Verdict
REPRODUCED (source-only). IRQ armed + cdev published before tws_init allocates reqs; window derefs sc->reqs[req_id]=NULL.
No comments yet.