tw_osl_cam: CAM completion-status fallback is dead code - unhandled CL error codes complete CCB with status 0 (CAM_REQ_INPROG)
Summary
tw_osl_complete_io error mapping 731-744: final fallback if(ccb_h.status==0) ccb_h.status=CAM_REQ_CMP_ERR is DEAD CODE. CAM_SIM_QUEUED(0x200) set at 257 only cleared at 755 AFTER the check. For TW_CL_ERR_REQ_UNABLE_TO_SUBMIT_COMMAND(0x40 tw_cl_intr.c:390) and TW_CL_ERR_REQ_GENERAL_FAILURE(0x01) no branch fires; status stays exactly 0x200; ==0 test fails; after 755 clear status=0=CAM_REQ_INPROG. cam_periph_error interprets as retryable -> excessive unintended retries. Comment at 739-742 documents intent not achieved. Fix: replace if(status==0) with final else.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1794 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Replace if(status==0) with else for correct fallback. | 402 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1794 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: none Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/raid/twa/tw_osl_cam.c:743-744.
Mechanism
tw_osl_complete_io final fallback if(ccb_h.status==0) is dead code: CAM_SIM_QUEUED bit always set at this point, so status never ==0, leaving general-failure errors unclassified (status stays CAM_REQ_INPROG).
Fix
Replace if(status==0) with else for correct fallback.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
twa.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- r
- a
- i
- d
- /
- t
- w
- a
- /
- t
- w
- _
- o
- s
- l
- _
- c
- a
- m
- .
- c
- :
- 7
- 4
- 3
- -
- 7
- 4
- 4
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/raid/twa/tw_osl_cam.c:743-744. Fix compiled clean.
PoC changes
authored fix.diff: replace if(status==0) with else
Verified recommended fix
Replace dead if(status==0) with else. Matches finding proposal.
Verdict
REPRODUCED (source-only). Dead-code fallback if(status==0) never fires (CAM_SIM_QUEUED bit always set); general-failure errors unclassified.
No comments yet.