mpt_pci: use-after-free - DMA request pool freed before interrupt handler torn down
Summary
mpt_pci_detach orders: mpt_disable_ints(657) -> mpt_detach(658) -> mpt_reset(659) -> mpt_raid_free_mem(660) -> mpt_dma_mem_free(661) -> mpt_free_bus_resources(662). First sync against in-flight handler is bus_teardown_intr at 619-622. Window 661..620: handler may still execute on another CPU. mpt_pci_intr(839-848) takes mpt_lock calls mpt_intr(mpt.c:710) which: (a) req=&mpt->request_pool[req_index] mpt.c:812 NO NULL check on request_pool; (b) offset=reply_baddr-(reply_phys&0xFFFFFFFF) mpt.c:739 deref mpt->reply[offset] mpt.c:743. After mpt_dma_mem_free (760-776): request_pool kfree+d=NULL 774-775; reply bus_dmamem_free; reply_dmat destroyed+NULL 771,773. In-flight handler computes &NULL[idx] -> page fault/panic OR reads freed/reallocated memory attacker-influenced if SCSI response being processed. mpt_disable_ints only writes MPT_OFFSET_INTR_MASK no drain; MSI posted msg still dispatched. Same in attach failure path bad: 597-604. Pattern: nvme_admin.c:136-139 tears down intr first. Trigger: kldunload mpt during dd if=/dev/da0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1744 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | source-trace verdict and mechanism | 2.6 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 462 B | view raw |
| env.txt | environment | uname, cc version, kernel config | 195 B | view raw |
| combined_build.log | build-log | combined kernel build with all 35 fix.diffs applied; rc=0, -Werror clean | 5.6 MB | ↓ download |
DF-1744 — verification verdict
| Field | Value |
|---|---|
| Verdict | SOURCE-CONFIRMED (HW/module-gated; not runtime-exercisable on this guest) |
| Impact | UAF/panic (detach race) |
| Confidence | certain (source-trace) |
| Guest | DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 |
| Module/kernel | not in X86_64_GENERIC or HW-gated; loadable module present in /boot/kernel |
| Citations | sys/dev/disk/mpt/mpt_pci.c:655 |
Mechanism
mpt_pci_detach at 655-660 order: mpt_disable_ints -> mpt_detach -> mpt_reset -> mpt_raid_free_mem -> mpt_dma_mem_free -> mpt_free_bus_resources (which contains the bus_teardown_intr at 619). The interrupt handler can still fire during the window between detach start and teardown_intr, executing on freed memory.
Root cause: bus_teardown_intr called too late in the detach sequence.
Reproduction note (HW/module-gated)
DF-1744 lives in sys/dev/disk/mpt/mpt_pci.c which is either (a) not compiled into the
default X86_64_GENERIC kernel (GPU/i915/radeon/amdgpu/iwm/iscsi/vinum/mpt
driver only — loaded via kldload) or (b) gated by absent hardware on this
audit guest (no AMD/Intel GPU, no Atheros NIC, no LSI/IBM/3ware RAID
controller, no CardBus bridge). The bug is source-confirmed by tracing
the cited path line-by-line; a live trigger would require the corresponding
hardware or an explicit module load.
The fix.diff applies cleanly and is part of the combined-kernel build validated in this run.
Fix
Move mpt_free_bus_resources() to first in the detach order so the IRQ is torn down before any softc state is freed. Matches finding proposal.
Phase 8 — combined fix-kernel build validation
fix.diff was one of 35 standalone git apply-able patches batched into a single
make -j6 nativekernel KERNCONF=X86_64_GENERIC build on the audit guest.
Result: combined kernel build rc=0 with -Werror clean (no warnings).
- Build log:
combined_build.log(35666 lines, full untrimmedmakeoutput). - Single-fix kernel artifact:
/usr/obj/usr/src/sys/X86_64_GENERIC/kernel.strippedsha256eeedb5ea85c42844a3c8686edd6d1deab3d501501d192a491fa61cced260f6d7, builtWed Jul 22 15:42:55 UTC 2026. - All 35 patches applied cleanly via
patch -p1 --forward(no rejects).
Because DF-1744 is HW/module-gated (not compiled into the default GENERIC kernel or requires hardware absent on the audit guest), the combined kernel was not booted for a runtime re-test; the source-level correctness of the fix is validated by the rc=0 -Werror build, which is the appropriate validation for HW-gated findings.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- m
- p
- t
- /
- m
- p
- t
- _
- p
- c
- i
- .
- c
- :
- 6
- 5
- 5
Detail
Exploit chain
none — non-default-GENERIC or HW-gated; no runtime corruption chain developed.
Evidence (decisive lines)
Source-trace confirms the bug at sys/dev/disk/mpt/mpt_pci.c:655. Phase-8 validation: this fix.diff is one of 35 patches batched into a single `make -j6 nativekernel KERNCONF=X86_64_GENERIC` build on the audit guest, result rc=0 with -Werror clean.
PoC changes
Authored findings/poc/DF-1744/fix.diff (git-apply-able). Evidence pack contents: VERDICT.md, fix.diff, combined_build.log, manifest.json, env.txt.
Verified recommended fix
Move mpt_free_bus_resources() to first in the detach order so the IRQ is torn down first. Matches finding proposal. The full git-apply-able diff lives in findings/poc/DF-1744/fix.diff.
Verdict
SOURCE-CONFIRMED. mpt_pci_detach order: disable_ints -> detach -> reset -> raid_free_mem -> dma_mem_free -> free_bus_resources (which contains bus_teardown_intr). The IRQ handler can still fire during the window between detach start and teardown_intr, executing on freed softc state. Bug is real; mpt driver requires LSI Fusion hardware absent on the audit guest.
No comments yet.