ata-siliconimage: OOB read in ata_sii_setmode PIO timing lookup (piotimings[mode&0x0f] on 5-element array with index 8..12)
Summary
ata_sii_setmode at 366 declares piotimings[5]={0x328a,0x2283,0x1104,0x10c3,0x10c1}. Line 410 PIO branch piotimings[mode & ATA_MODE_MASK]. ATA_MODE_MASK=0x0f (nata.h:200) ATA_PIO0=0x08 (nata.h:203) so masked index 8..12 (PIO4=0x0c->12). OOB read 3..8 uint16 slots past array end. Sibling ata_cmd_setmode at 268 correctly subtracts ATA_PIO0. ata_limit_mode reduces to ATA_PIO0..ATA_PIO4=0x08..0x0c. Fires on every PIO-only device attach on SiI 0680. Garbage .rodata bytes programmed as PIO timing -> unreliable transfers potential data corruption. Malicious SATA/ATAPI device firmware can force PIO-only IDENTIFY. Fix: piotimings[(mode & ATA_MODE_MASK) - ATA_PIO0]. Same bug in ata-cyrix.c:98.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1782 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Subtract ATA_PIO0 from the masked index. | 517 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1782 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: none Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/disk/nata/chipsets/ata-siliconimage.c:410.
Mechanism
ata_sii_setmode PIO branch indexes piotimings[mode & ATA_MODE_MASK] where masked index is 8-12 for PIO0-PIO4, reading 3-8 uint16 past the 5-element array; garbage programmed as PIO timing.
Fix
Subtract ATA_PIO0 from the masked index.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
nata module built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- i
- s
- k
- /
- n
- a
- t
- a
- /
- c
- h
- i
- p
- s
- e
- t
- s
- /
- a
- t
- a
- -
- s
- i
- l
- i
- c
- o
- n
- i
- m
- a
- g
- e
- .
- c
- :
- 4
- 1
- 0
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/disk/nata/chipsets/ata-siliconimage.c:410. Fix compiled clean.
PoC changes
authored fix.diff: subtract ATA_PIO0 from masked index
Verified recommended fix
Subtract ATA_PIO0 from masked index. Matches finding proposal.
Verdict
REPRODUCED (source-only). piotimings[mode & ATA_MODE_MASK] indexes 8-12 for PIO0-4; 3-8 uint16 past 5-element array. Garbage programmed as PIO timing.
No comments yet.