ida_detach frees DMA maps and QCB memory while I/O may be in flight: UAF/panic
Summary
ida_detach L276-298 calls ida_free unconditionally without draining in-flight QCBs waiting for outstanding ida_command tsleepers or flushing bio_queue. XXX comment L283-287 acknowledges requirement but no drain logic. ida_free L67-104: L72-73 bus_dmamap_destroy while command may tsleep ida_wait:450 on that qcb; L79-80 kfree hwqcb arena ida_wait:455/ida_intr:483 deref freed; L88-89 kfree qcb array; L91-92 bus_teardown_intr pending interrupt on another CPU still executes ida_intr against half-freed softc. ida_command:355 thread tsleep on qcb wakeup ida_done:528 cant fire IRQ gone loops ETIMEDOUT ida_wait:451 qcb freed memory ida_done:466 deref. No idad_detach/disk_destroy before backend -> bios keep arriving idad_strategy. Trigger: kldunload ida while I/O in flight root; or surprise hot-unplug physical access. Impact: kernel panic common; potential code-exec if freed arena repurposed. Fix: fail-fast EBUSY if any QCB_ACTIVE; disable IRQ drain completions; call disk_destroy for children first.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1915 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 253 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 702 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1915 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: ida_detach L276-298 calls ida_free unconditionally without draining in-flight QCBs waiting for outstanding ida_command tsleepers or flushing bio_queue. XXX comment L283-287 acknowledges requirement bu
Citation: sys/dev/raid/ida/ida.c:276-298
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: ida_detach frees DMA maps/QCB while I/O in flight (ida.c:276-298)
Verified recommended fix
Source-confirmed: ida_detach frees DMA maps/QCB while I/O in flight (ida.c:276-298)
Verdict
Source-confirmed: ida_detach frees DMA maps/QCB while I/O in flight (ida.c:276-298)
No comments yet.