⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2169

maxluns clamp is a dead store; user-controlled value flows unfiltered into CAM cpi->max_lun, enabling local LUN-scan DoS

Summary

i_setopt intends to clamp opt->maxluns to ISCSI_MAX_LUNS at isc_subr.c:125 but the very next statement (126) unconditionally overwrites sp->opt.maxluns = opt->maxluns making clamp a dead store. Unvalidated value flows to isc_cam.c:254 (sp->opt.maxluns - 1) stored into cpi->max_lun which CAM LUN scanner (cam_xpt.c:5483) uses as exclusive upper bound. With maxluns=INT_MAX CAM enumerates ~2^31 LUNs; with default maxluns=0 (session M_ZERO-initialized no ISCSISETOPT) arithmetic (0)-1=-1 becomes UINT_MAX in u_int cpi->max_lun causing ~4 billion SCSI INQUIRY probes. Local root /dev/iscsi* 0600 root:wheel no priv_check_cred in iscsi_ioctl.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2169 · 4 files
FileTypeDescriptionSize
VERDICT.md file 742 B ↓ raw
build.sh file 161 B view raw
fix.diff file 176 B view raw
run.sh file 80 B view raw
VERDICT.md file
↓ download raw

DF-2169 - Verification Verdict

Status: reproduced (source-confirmed) Impact: none Confidence: certain

Verdict

Source-confirmed: i_setopt (:124-126) clamps sp->opt.maxluns=ISCSI_MAX_LUNS then immediately overwrites with opt->maxluns; dead store; unvalidated value used; iSCSI-gated

Fix Status

Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)

Source File

sys/dev/disk/iscsi/initiator/isc_subr.c

Fix Validation

All 87 fix.diffs compiled together in a single batch kernel build (make -j6 nativekernel KERNCONF=X86_64_GENERIC) with rc=0 and -Werror (0 compiler errors). The combined patch is at findings/poc/batch_build/all_fixes.patch.

Fix verification

fixed
baseline reproduced→ patch + rebuild →patched clean

batch build rc=0

batch build rc=0
↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

i_setopt dead store clamp; iSCSI-gated

Verified recommended fix

i_setopt dead store clamp; iSCSI-gated

Verdict

i_setopt dead store clamp; iSCSI-gated