OOB array access in sili_port_read_ncq_error via unchecked device-supplied NCQ tag
Summary
In sili_port_read_ncq_error failed NCQ tag extracted from device-supplied LOG page 10h as err_slot=log->err_regs.type&ATA_LOG_10H_TYPE_TAG_MASK (5 bits range 0..31). Value used directly as index into ap->ap_ccbs without validating against sc->sc_ncmds(31). ap_ccbs has only 31 entries (indices 0..30) so err_slot=31 is OOB. Bounds check at :2141 reads ccb->ccb_slot from OOB CCB rather than validating err_slot. If OOB memory matches expired slot bit memcpy writes device-controlled FIS data through wild ccb_prb pointer read from OOB heap. If ccb_prb NULL NULL-deref panic. If heap metadata wild-pointer write.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2518 · 6 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source trace confirming DF-2518 bug is real but HW-gated | 1.3 KB | ↓ raw |
| fix.diff | suggested-fix | Validate err_slot < sc->sc_ncmds before indexing ap->ap_ccbs | 506 B | view raw |
| env.txt | environment | Guest gate proof: kldstat, pciconf, camcontrol (no target HBA) | 1.1 KB | view raw |
| build.sh | build-script | No buildable PoC (HW-gated) | 384 B | view raw |
| run.sh | run-script | Gate verification commands | 411 B | view raw |
| README.md | readme | Overview of HW-gated finding | 791 B | ↓ raw |
HW-gated SCSI/FC HBA driver finding
This finding targets a SCSI/FC/SATA HBA driver that is not present in this QEMU/KVM guest (only PIIX3 IDE + virtio). The driver cannot attach and the cited code path is unreachable at runtime.
Reproduction status: NOT REPRODUCED (HW-gated)
- The source bug is confirmed real by line-by-line source trace (see VERDICT.md).
- It cannot be triggered because the HBA hardware/driver does not exist on this guest.
- A defense-in-depth
fix.diffhas been authored and validated withgit apply --check.
Evidence
VERDICT.md— full source trace and analysisenv.txt— guest environment (kldstat, pciconf, camcontrol gate proof)fix.diff— git-apply-able defense-in-depth fixmanifest.json— machine-readable catalog
DF-2518 — OOB array access in sili_port_read_ncq_error
Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED
Hardware gate
No SiliconImage 3124/3132 SATA HBA in guest: kldstat shows only kernel/ehci/xhci;
pciconf -l shows no SiliconImage PCI device.
Source trace (confirmed real bug)
File: sys/dev/disk/sili/sili.c:2138-2140
err_slot = log->err_regs.type & ATA_LOG_10H_TYPE_TAG_MASK; // 5-bit, range 0..31
ccb = &ap->ap_ccbs[err_slot]; // OOB when err_slot == 31
ap->ap_ccbs is allocated as kmalloc(sizeof(struct sili_ccb) * sc->sc_ncmds, ...)
(line 211). sc_ncmds is typically 31. So ap_ccbs has indices 0..30. The NCQ tag
is a 5-bit field (0..31); err_slot == 31 is OOB. The "bounds check" at line 2141
reads ccb->ccb_slot from the OOB CCB rather than validating err_slot. If the OOB
memory matches an expired slot bit, memcpy writes device-controlled FIS data through
a wild ccb_prb pointer read from OOB heap — wild-pointer write or NULL-deref panic.
Fix
Added if (err_slot >= sc->sc_ncmds) { ... break; } validation before indexing
ap->ap_ccbs. See fix.diff.
Impact (on HW that has the HBA)
Medium — OOB heap read/write via device-supplied NCQ error log page tag=31.
Fix verification
not_testablenot_testable: target driver cannot attach (no target HBA). fix.diff validated with git apply --check (EXIT=0); fix is correct by source trace.
git apply --check findings/poc/DF-2518/fix.diff => EXIT=0. No runtime test possible (no target HBA).
Confirmed kernel references
Detail
Exploit chain
none — valid hard blocker (driver code path dead at runtime on this guest: no target HBA). No unprivileged->root path.
Evidence (decisive lines)
kldstat -> kernel/ehci/xhci only (no target driver); pciconf -l -> PIIX3 IDE + virtio only (no target HBA); camcontrol devlist -> only <QEMU QEMU DVD-ROM>. Source confirmed at cited lines.
PoC changes
Created findings/poc/DF-2518/{VERDICT.md,fix.diff,manifest.json,env.txt,build.sh,run.sh,README.md}. No PoC source (HW-gated).
Verified recommended fix
Defense-in-depth fix.diff closes the cited path (see findings/poc/DF-2518/fix.diff; git apply --check OK).
Verdict
NOT REPRODUCED (HW-gated). The bug is REAL in source (traced line-by-line): sili OOB array access in sili_port_read_ncq_error (needs SiliconImage SATA HBA). Gate confirmed: kldstat (only kernel+ehci+xhci; no isp/mpt/sili/trm/sbp module loaded), pciconf -l (no QLogic ISP/LSI MPT/SiliconImage/Tekram/FireWire HBA — only PIIX3 IDE atapci0 + virtio), camcontrol devlist (only QEMU DVD-ROM). The target driver cannot attach so the cited code path is dead at runtime on this guest.
No comments yet.