DF-2497 — unbounded SPAN/JBOD disk-index walk in ata_raid_strategy (OOB read / hang)

What was verified

sys/dev/disk/nata/ata-raid.c:352-353:

case AR_T_JBOD:
case AR_T_SPAN:
    drv = 0;
    lba = blkno;
    while (lba >= rdp->disks[drv].sectors)
        lba -= rdp->disks[drv++].sectors;      /* NO BOUND */

The walk has no bound against rdp->total_disks, MAX_DISKS (16), or the size of the struct ar_softc allocation (2424 bytes; disks[] at +112, 48 bytes/entry, so disks[49] is the first entry past the object). A bio whose block number is beyond the sum of the configured per-disk sectors — trivially reachable with crafted metadata — makes drv climb through the whole kernel heap at a 48-byte stride.

Both proven through 100% production code (rig: production ata-raid.c compiled into a KLD, HPTv2 SPAN metadata crafted exactly as a crafted disk would present it, only ata_queue_request interposed):

• test 11 (deterministic) — production ata_raid_hptv2_read_meta() installs type=AR_T_SPAN, total_disks=2, disks[0].sectors=0, disks[1].sectors=1000 from crafted metadata. Production ata_raid_strategy() with blkno=5000: the walk read rdp->disks[drv].sectors for drv = 0,1,…,29 (all past total_disks=2, indices ≥16 past MAX_DISKS), stopped on a single harness stopper planted at the disks[30].sectors stride, and dispatched I/O with request->this(drv)=30 and request->dev = rdp->disks[30].dev — both OOB reads (run_nonfatal.log, run_test13.log).
• test 13 (past the allocation, natural heap) — same setup, no planted stop within the object: the production walk continued past index 48 and reached disk index 51, reading disks[51].sectors/.flags/.dev 168+ bytes past the end of the 2424-byte heap object, stopping on natural heap contents and dispatching with this(drv)=51 (run_test13.log + serial STRATEGY DISPATCH lines).

Hang aspect (as filed): while climbing, any OOB region that reads as zero never satisfies the loop condition with a smaller lba, so the loop keeps advancing (lba -= 0) until it reaches a value ≥ lba (kernel pointers usually stop it) or unmapped memory (page fault). On this guest the walk stopped on mapped heap both times; a panic is heap-layout-dependent, and the "hang" variant is the same walk with an all-zero region. Impact: kernel heap OOB read at attacker-chosen stride (blkno is attacker-controlled), plus I/O dispatch to an OOB-read device pointer.

Build / run (guest, root; requires vm.sh reset with-src)

cd /root/dfrig3 && ./build.sh
kldload ./dfrig3_ata.ko
sysctl kern.dfrig3_ata_test=11    # SPAN walk, deterministic (drv=30)
sysctl -n kern.dfrig3_ata_status
sysctl kern.dfrig3_ata_test=13    # walk past the allocation (drv>=49)
sysctl -n kern.dfrig3_ata_status

Expected (baseline): status shows PROOF: production strategy dispatched to disk index drv=this=NN (>= MAX_DISKS / past the allocation).

Fix validation

fix.diff bounds the walk (while (drv < (int)rdp->total_disks && …)) and fails the bio with EIO when blkno is past the array end. On the single-fix kernel (fix_validation.log): both tests show dispatches=0, ar0: I/O beyond end of SPAN/JBOD array, rig_bio_done b_error=5 (EIO) — no OOB read, no dispatch.

DF-2497 VERDICT — reproduced (OOB read walk past total_disks, past MAX_DISKS, past the allocation)

Bottom line

CONFIRMED. The JBOD/SPAN branch of the production ata_raid_strategy() (sys/dev/disk/nata/ata-raid.c:352-353) walks rdp->disks[drv].sectors with drv++ and no bound of any kind. Driven with a bio whose block number is past the array end (the per-disk sector table comes verbatim from crafted HPTv2 SPAN metadata: total_disks=2, disks[1].sectors=1000):

1. Deterministic in-object proof (test 11): the walk consumed the configured disks, then kept reading rdp->disks[2..30].sectors — 29 entries past total_disks=2, 15 past MAX_DISKS=16 — and the production code then dispatched I/O using the OOB-read rdp->disks[30].dev as the target device (shim captured this(drv)=30, dev=0xffffffff8260b3c0). The only harness interposition besides the I/O shim is one planted valid stopper at the disks[30].sectors stride so the walk terminates at a mapped, valid address instead of depending on heap luck; every index the production loop read beyond the configured disks is the bug.
2. Past-the-allocation proof (test 13): without an in-object stopper, the production walk continued past index 48 (first index past the 2424-byte struct ar_softc allocation; disks[] at +112, 48 bytes/entry) and reached drv=51, reading .sectors/.flags/.dev from unrelated kernel heap 168+ bytes past the object, then dispatched with that OOB-read .dev pointer.

The walk extent is attacker-influenced (blkno comes from the bio; bigger blkno → farther walk). Termination depends on heap contents: kernel pointers (0xffff…) stop it; zero regions make the loop climb forever (lba -= 0) — the filed "hang" variant; unmapped pages would fault. On this guest both runs stopped on mapped heap, so no panic was forced; the primitive (unbounded heap OOB read + dispatch to garbage device pointer) is fully demonstrated.

Threat model

Crafted on-disk SPAN/JBOD metadata (e.g., HPTv2 HPTV2_T_SPAN with small total_sectors) makes the array's usable sector sum far smaller than any bio offset an unprivileged filesystem user can request once the array is mounted; every read past the sum walks kernel heap OOB.

Fix validation (single-fix kernel)

fix.diff bounds the walk with drv < (int)rdp->total_disks and fails out-of-range I/O (biofinish(bp, NULL, EIO) + "ar%d: I/O beyond end of SPAN/JBOD array"). On the fixed kernel (fix_validation.log): test 11 and test 13 both show dispatches=0, the beyond-end message, and rig_bio_done b_error=5 — the walk never leaves the configured disks. In-range SPAN I/O still works (the shim dispatched normally in DF-2496 test20's RAID0 path; the SPAN chunk computation below the new bound is unchanged).

Kernel references

• sys/dev/disk/nata/ata-raid.c:348-355 — the unbounded JBOD/SPAN walk
• sys/dev/disk/nata/ata-raid.c:397-411 — dispatch using OOB-read rdp->disks[drv].flags/.dev
• sys/dev/disk/nata/ata-raid.h:97-110 — struct ar_disk (48 bytes) and disks[MAX_DISKS=16]
• sys/dev/disk/nata/ata-raid.c:1844-1894 — HPTv2 SPAN parse installing per-disk sectors verbatim

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.