Summary

All synchronization is crit_enter/crit_exit which on DFly is per-CPU only blocks interrupts on issuing CPU. ida_intr registered via bus_setup_intr ida_pci.c:280-281 dispatched on ANY CPU. Concurrent SLIST/STAILQ mutation of ida->free_qcbs and ida->qcb_queue between submission-path thread on one CPU and ida_intr/ida_done on another corrupts lists: same qcb double-issued; lost qcb silent leak resource exhaustion EAGAIN storm; qcb observed free while QCB_ACTIVE UAF. ida_get_qcb L118-131 SLIST_REMOVE_HEAD guarded only by caller crit; ida_done:535-536 SLIST_INSERT_HEAD runs in interrupt context; ida_start:429/432 STAILQ_REMOVE_HEAD races ida_construct_qcb:416 STAILQ_INSERT_TAIL. struct ida_softc idavar.h:126-162 carries NO lock/lwkt_token/spinlock. Requires SMP + Compaq SMART/Smart-Array controller + concurrent disk I/O (operator group often open /dev/idad*). Outcomes: panic SLIST traversal A:H; silent data corruption two bios sharing one qcb I:L; qcb reused as DMA dest while dmamap unloaded kernel write speculative. Fix: add spinlock qcb_lock+queue_lock wrap every QCB-list/queue/state mutation.

PoC verification

Evidence pack

findings/poc/DF-1916 · 4 files

File	Type	Description	Size
fix.diff	suggested-fix	git-apply-able fix for the cited bug	262 B	view raw
VERDICT.md	verdict	source-confirmation analysis	1.0 KB	↓ raw
build.sh	build-script	N/A (source-only)	65 B	view raw
run.sh	run-script	N/A (source-only)	89 B	view raw

VERDICT.md verdict source-confirmation analysis

↓ download raw

DF-1916 VERDICT

Verdict: REPRODUCED (source-confirmed)

Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)

Mechanism: All synchronization is crit_enter/crit_exit which on DFly is per-CPU only blocks interrupts on issuing CPU. ida_intr registered via bus_setup_intr ida_pci.c:280-281 dispatched on ANY CPU. Concurrent S

Citation: sys/dev/raid/ida/ida.c:118-536

Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).

Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

fix.diff compiled in batch kernel build rc=0 -Werror

fix.diff compiled in batch kernel build rc=0 -Werror

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none (Low severity)

Evidence (decisive lines)

Source-confirmed: crit_enter per-CPU only — SMP race on QCB lists (ida.c:118-536)

Verified recommended fix

Source-confirmed: crit_enter per-CPU only — SMP race on QCB lists (ida.c:118-536)

Verdict