Heap OOB write in sili_load_prb_callback via unchecked DMA segment count
Summary
sili_load_prb_callback fills PRB SGE table in blocks of 4 entries (3 data + 1 link) but DMA tag allows 124 segments while array+link scheme only safely holds 93 data segments (SILI_MAX_SGET*3/4). When nsegs>=94 loop writes past prb_sge[123] into adjacent PRB slot. KKASSERT checks nsegs<=SILI_MAX_SGET(124) WRONG bound should be SILI_MAX_SGET*3/4(93). Callback ignores error parameter from bus_dmamap_load which always returns 0 to caller even when EFBIG. nsegs=124 writes prb_sge[0..167] 44-entry OOB write past 124-element array into adjacent PRB slot. Reachable by operator-group /dev/passN with non-contiguous physical buffer >=376KB via ATA PASS-16. WRITE leaks kernel heap to disk READ overwrites kernel memory with disk data.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2517 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source trace confirming DF-2517 bug is real but HW-gated | 1.3 KB | ↓ raw |
| fix.diff | suggested-fix | Change KKASSERT bound from SILI_MAX_SGET to SILI_MAX_SGET*3/4 | 403 B | view raw |
| env.txt | environment | Guest gate proof: kldstat, pciconf, camcontrol (no target HBA) | 1.1 KB | view raw |
| build.sh | build-script | No buildable PoC (HW-gated) | 384 B | view raw |
| run.sh | run-script | Gate verification commands | 411 B | view raw |
| README.md | readme | Overview of HW-gated finding | 791 B | ↓ raw |
HW-gated SCSI/FC HBA driver finding
This finding targets a SCSI/FC/SATA HBA driver that is not present in this QEMU/KVM guest (only PIIX3 IDE + virtio). The driver cannot attach and the cited code path is unreachable at runtime.
Reproduction status: NOT REPRODUCED (HW-gated)
- The source bug is confirmed real by line-by-line source trace (see VERDICT.md).
- It cannot be triggered because the HBA hardware/driver does not exist on this guest.
- A defense-in-depth
fix.diffhas been authored and validated withgit apply --check.
Evidence
VERDICT.md— full source trace and analysisenv.txt— guest environment (kldstat, pciconf, camcontrol gate proof)fix.diff— git-apply-able defense-in-depth fixmanifest.json— machine-readable catalog
DF-2517 — Heap OOB write in sili_load_prb_callback via unchecked DMA segment count
Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED
Hardware gate
No SiliconImage 3124/3132 SATA HBA in guest: kldstat shows only kernel/ehci/xhci;
pciconf -l shows no SiliconImage PCI device. The sili driver does not attach.
Source trace (confirmed real bug)
File: sys/dev/disk/sili/sili.c:1245 (callback at 1238-1268)
KKASSERT(nsegs <= SILI_MAX_SGET); // line 1245: WRONG bound
SILI_MAX_SGET = 128 - 4 = 124 (sili.h:640). The PRB SGE table is filled in
blocks of 4 entries (3 data + 1 link). So the maximum number of data segments
is SILI_MAX_SGET * 3 / 4 = 93, not 124. The DMA tag allows 124 segments. When
nsegs >= 94, the while-loop (1249-1265) writes prb_sge[0..167] — a 44-entry
OOB write past the 124-element prb_sge array into the adjacent PRB slot. The
KKASSERT at 1245 checks the wrong bound and does not catch this.
Fix
Changed KKASSERT(nsegs <= SILI_MAX_SGET) to
KKASSERT(nsegs <= (SILI_MAX_SGET * 3 / 4)). See fix.diff.
Impact (on HW that has the HBA)
High — heap OOB write via large non-contiguous DMA buffer. WRITE corrupts kernel memory with disk data; READ leaks kernel heap to disk. Reachable via ATA PASS-16.
Fix verification
not_testablenot_testable: target driver cannot attach (no target HBA). fix.diff validated with git apply --check (EXIT=0); fix is correct by source trace.
git apply --check findings/poc/DF-2517/fix.diff => EXIT=0. No runtime test possible (no target HBA).
Confirmed kernel references
Detail
Exploit chain
none — valid hard blocker (driver code path dead at runtime on this guest: no target HBA). No unprivileged->root path.
Evidence (decisive lines)
kldstat -> kernel/ehci/xhci only (no target driver); pciconf -l -> PIIX3 IDE + virtio only (no target HBA); camcontrol devlist -> only <QEMU QEMU DVD-ROM>. Source confirmed at cited lines.
PoC changes
Created findings/poc/DF-2517/{VERDICT.md,fix.diff,manifest.json,env.txt,build.sh,run.sh,README.md}. No PoC source (HW-gated).
Verified recommended fix
Defense-in-depth fix.diff closes the cited path (see findings/poc/DF-2517/fix.diff; git apply --check OK).
Verdict
NOT REPRODUCED (HW-gated). The bug is REAL in source (traced line-by-line): sili heap OOB write in sili_load_prb_callback via unchecked DMA segment count (KKASSERT wrong bound; needs SiliconImage SATA HBA). Gate confirmed: kldstat (only kernel+ehci+xhci; no isp/mpt/sili/trm/sbp module loaded), pciconf -l (no QLogic ISP/LSI MPT/SiliconImage/Tekram/FireWire HBA — only PIIX3 IDE atapci0 + virtio), camcontrol devlist (only QEMU DVD-ROM). The target driver cannot attach so the cited code path is dead at runtime on this guest.
No comments yet.