tws_init_connect leaks sole internal-request slot on poll failure permanently disabling controller init/reset
Summary
tws_init_connect L188-208: tws_poll4_response returns unexpected reqid or TWS_INVALID_REQID -> return(FAILURE) but never marks req->state=TWS_REQ_STATE_FREE. tws_get_request(TWS_INTERNAL_CMD_REQ) returns singleton &sc->reqs[0] tws.c:752 only succeeds when state FREE. One init_connect failure permanently bricks all future internal commands including controller reset recovery tws_cam.c:1263 and post-reset re-init tws.c:366/711. tws_reinit calls init_connect during recovery so first reset that loses response-queue race leaks slot breaks all subsequent recoveries. tws_poll4_response returns TWS_INVALID_REQID on 60s timeout reachable for slow/stuck controller. Attacker: PCI-passthrough/malicious firmware stays silent. Fix: req->state=TWS_REQ_STATE_FREE in error branch.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1926 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 469 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 706 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1926 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: tws_init_connect L188-208: tws_poll4_response returns unexpected reqid or TWS_INVALID_REQID -> return(FAILURE) but never marks req->state=TWS_REQ_STATE_FREE. tws_get_request(TWS_INTERNAL_CMD_REQ) retu
Citation: sys/dev/raid/tws/tws_hdm.c:188-207
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: init_connect failure doesn't free singleton req slot (tws_hdm.c:188-207)
Verified recommended fix
Source-confirmed: init_connect failure doesn't free singleton req slot (tws_hdm.c:188-207)
Verdict
Source-confirmed: init_connect failure doesn't free singleton req slot (tws_hdm.c:188-207)
No comments yet.