DF-2275 verification pack — DAIOCTRIM KKASSERT panic on misaligned user range

Bug: sys/bus/cam/scsi/scsi_da.c:443-444 — the DAIOCTRIM handler enforces 512-byte alignment of the USER-SUPPLIED off_t pair with two KKASSERT()s instead of returning EINVAL. On the stock INVARIANTS kernel any successful opener of a /dev/daX node (gated by SYSCAP_RESTRICTEDROOT at daopen, scsi_da.c:505) can panic the machine with one ioctl.

Verdict: REPRODUCED (privileged-reach kernel panic / local DoS) — fix validated A/B.

Both asserts were tripped independently from an unprivileged-looking userland program through the REAL dispatch:

open("/dev/da99") -> daopen (real, SYSCAP gate passed as root)
ioctl(fd, DAIOCTRIM, {0, 4104})
  -> syscall2 -> mapped_ioctl (16-byte copyin)
  -> devfs_fo_ioctl -> dev_dioctl -> daioctl (real d_ioctl handler)
  -> panic: assertion "(bytes_left % 512) == 0" failed in daioctl

ioctl(fd, DAIOCTRIM, {520, 4096})
  -> panic: assertion "(bytes_start% 512) == 0" failed in daioctl

Panic traces in panic.txt / serial_mlen_full.log / serial_moff_full.log. The panic cites scsi_da.c:558 / :559 — that is the CONCATENATED harness file; subtract the 115-line preamble and you land exactly on verbatim lines 443 / 444 of the audited file (sha256-gated byte-for-byte, rig/verbatim.log).

Rig (kernel-compiled harness — CAM verbatim-interposition pattern)

The guest build tree copy of scsi_da.c is replaced IN PLACE by df_pre.c + VERBATIM scsi_da.c + df_post.c (rig/gen.sh); device da stays configured so the harness is the one and only compiled instance of the driver. The guest boots from vbd0 (virtio-blk) and has no real da device, so nothing else changes at boot. Only EXTERNAL symbols are interposed, per-object pass-through (fabricated da99 only): dev_dstrategy, xpt_schedule, xpt_action, xpt_setup_ccb, cam_periph_getccb, cam_periph_runccb, xpt_release_ccb, xpt_path_periph, xpt_path_serialno.

Everything between the syscall and the panic is REAL kernel code: mapped_ioctl copyin (sys/kern/sys_generic.c:681-724), devfs_fo_ioctl, dev_dioctl, daioctl, and (for the functional control) daopen, dacheckmedia, dagetcapacity, dasetgeom, dastrategy, dastart, dadone, getnewbuf, biowait, biodone, brelse, cam_extend, make_dev(&da_ops).

The fabricated SECOND disk da99 (real make_dev, real da_ops, real periph in the real daperiphs array, fake transport answering READ CAPACITY) never touches the boot disk.

Build

cd rig && ./build.sh          # full kernel + install + reboot (~30 min)

Run (baseline = vulnerable)

./run_baseline.sh             # non-destructive controls + DF-2276 cases
./run_panic.sh mlen           # PANIC at scsi_da.c:443
./run_panic.sh moff           # PANIC at scsi_da.c:444

Expected (vulnerable kernel)

panic: assertion "(bytes_left % 512) == 0" failed in daioctl ...
panic: assertion "(bytes_start% 512) == 0" failed in daioctl ...
backtrace: daioctl -> dev_dioctl -> devfs_fo_ioctl -> mapped_ioctl -> syscall2

Fixed kernel (A/B)

scp fix2275_2276.diff make_fix.sh dfbsd:/root/
ssh dfbsd 'sh /root/make_fix.sh' && cd rig && ./quick.sh && ./run_fixed.sh

mlen/moff -> ioctl returned r=-1 errno=22 (Invalid argument), guest stays up
aligned {0,4096} -> SUCCESS with identical TRIM CDB (1 range, lba 0, 8 blks)

Impact ceiling: honest note — the ioctl is only reachable after opening a da device, and daopen rejects everyone lacking SYSCAP_RESTRICTEDROOT (scsi_da.c:505), so this is a PRIVILEGED-reach denial of service (panic), not an unprivileged privesc. It is still a kernel-diagnostic-as-input- validation defect: a maintenance ioctl must never be able to panic a production (non-INVARIANTS) kernel — note on non-INVARIANTS kernels KKASSERT compiles to a no-op and the misaligned values fall through to the DF-2276 loop machinery instead (see ../DF-2276).

Artifacts: panic.txt, run.log, build.log, fix.diff, fix_build.log, fix_run.log, env.txt, rig/ (df_pre.c, df_post.c, gen.sh, check_verbatim.sh, build.sh, quick.sh, run_baseline.sh, run_panic.sh, run_fixed.sh, da_user.c, full logs, disasm).

DF-2275 VERDICT — REPRODUCED (privileged-reach panic), fix validated

What was claimed

sys/bus/cam/scsi/scsi_da.c:443-444:

case DAIOCTRIM:
{
    bytes_left = del_num[1];
    bytes_start = del_num[0];

    /* TRIM occurs on 512-byte sectors. */
    KKASSERT((bytes_left % 512) == 0);     /* :443 */
    KKASSERT((bytes_start% 512) == 0);     /* :444 */

User-supplied alignment is enforced by kernel DIAGNOSTIC assertions; a bad value must produce EINVAL, not a panic.

How it was verified (mechanically, through the real d_ioctl dispatch)

1. Rig. A DragonFly 6.5-DEVELOPMENT X86_64_GENERIC INVARIANTS kernel was built in which the driver file is df_pre.c + byte-for-byte scsi_da.c + df_post.c (rig/gen.sh; verbatim gate rig/verbatim.log: embedded copy sha256 3c795c0f8aa93c9f2833b46727a64adbc8b50df02ef6cde2b616755a7160a148 == pristine guest copy == audit tree). The harness fabricates a SECOND disk, da99: real make_dev(&da_ops, dkmakeunit(99), root:operator 0600) creating /dev/da99, a real cam_periph registered in the real daperiphs, and a fake transport that answers READ CAPACITY(10) during the real daopen/dacheckmedia/dagetcapacity/dasetgeom chain. The boot disk (vbd0) is untouched; the real da driver is the ONLY compiled copy (device da stays configured).

2. Gate check (source line-accurate). daopen rejects openers with caps_priv_check_self(SYSCAP_RESTRICTEDROOT) (scsi_da.c:505). daioctl has NO capability check, NO softc/d_trimflag check, and no lock between entry and the asserts — only dkunit(dev) + cam_extend_get(daperiphs, unit) (scsi_da.c:429-431). DAIOCTRIM is _IOW('C', 128, off_t[2]) (sys/bus/cam/scsi/scsi_daio.h:38); mapped_ioctl copyins the 16 bytes into a kernel buffer before the driver sees them (sys/kern/sys_generic.c:681-724), so del_num[] is fully attacker data.

3. Panic 1 (bytes_left). Userland ioctl(fd, DAIOCTRIM, {0, 4104}) on /dev/da99 (opened through the REAL daopen — root passes the caps gate):

   panic: assertion "(bytes_left % 512) == 0" failed in daioctl at /usr/src/sys/bus/cam/scsi/scsi_da.c:558 daioctl() at daioctl+0x34d dev_dioctl() at dev_dioctl+0x65 devfs_fo_ioctl() at devfs_fo_ioctl+0x95 mapped_ioctl() at mapped_ioctl+0x5fa syscall2() at syscall2+0x11e

558 - 115 (preamble lines) = 443 — the exact audited line.

4. Panic 2 (bytes_start). ioctl(fd, DAIOCTRIM, {520, 4096}):

   panic: assertion "(bytes_start% 512) == 0" failed in daioctl at /usr/src/sys/bus/cam/scsi/scsi_da.c:559 [= verbatim 444] (same backtrace)

Full serial console output: panic.txt, serial_mlen_full.log, serial_moff_full.log. Both runs took the whole guest down (DDB), i.e. the panic is a full machine DoS from one syscall.

5. Controls on the same kernel. Aligned {0,4096} completes the ENTIRE real TRIM path successfully (see ../DF-2276 run.log: XPT_TRIM CDB, 1 range, lba 0 count 8, dxfer 512) — proving the panics are caused by the misalignment itself, not by harness damage.

Honest impact assessment

• Reach: the trigger must first OPEN a da device; daopen gates on SYSCAP_RESTRICTEDROOT (scsi_da.c:505). So: privileged-reach (root or RESTRICTEDROOT-capable) local DoS. No unprivileged path exists on a default system; no privesc.
• On production kernels built WITHOUT INVARIANTS the KKASSERTs vanish and the misaligned request falls into the DF-2276 loop machinery instead (misaligned start advances by full 512 blocks; misaligned length loops forever issuing TRIMs — see ../DF-2276). The two findings are the INVARIANTS and non-INVARIANTS faces of the same missing validation.

Fix validation (A/B, single-fix kernel)

fix.diff replaces both asserts with EINVAL checks plus a negative-range reject (the negative part belongs to DF-2276; one combined diff validated for both). Baseline kernel (uname #1, Oct 18 01:07) vs fixed kernel (uname #2, Oct 18 01:35), identical harness:

fix_status: fixed (bad behavior gone, functional path preserved).

Upstream comparison

FreeBSD has no DAIOCTRIM; its equivalent, DIOCGDELETE _IOW('d',136, off_t[2]), is validated in the GEOM layer BEFORE any work: sys/geom/geom_dev.c:609-618 rejects (offset % sectorsize) != 0 || (length % sectorsize) != 0 || length <= 0 with EINVAL and iterates while (length > 0). The validated fix mirrors that canonical shape (EINVAL for misalignment, reject non-positive lengths) while keeping the DragonFly dispatch structure.

Files

panic.txt (both console traces), run.log (decisive excerpts), build.log (full kernel build), fix.diff, fix_build.log, fix_run.log, env.txt, serial_mlen_full.log, serial_moff_full.log, rig/ (all sources + raw logs: run_baseline_outer.log, run_panic_mlen.log, run_fixed_outer.log, disasm_daioctl_fixed.txt shows the patched daioctl sign-check branches).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.