DF-3691 — No parser validates array width; the I/O strategy turns it into OOB disks[] access (incl. wild dev deref and OOB last_lba writes)

Root cause (source)

Every vendor parser copies an attacker-controlled "array width" into raid->width with no check against MAX_DISKS (disks[] is 16 entries):

• Adaptec :1685 width = be16toh(configs[0].total_disks) — 16-bit (0..65535)
• HPTv2 :1868 width = meta->array_width (u8)
• HPTv3 :2039/:2045/:2051/:2057 width = configs[0].total_disks (u8, or /2)
• LSI v2 :2828/:2835/:2843 array_width (u8)
• LSI v3 :2971/:2976 total_disks/array_width (u8)
• nVidia :3108 array_width (u8)
• Promise :3248 array_width (u8)
• SII :3563 raid0_disks (u8)

total_disks (which gates READY) is a separate metadata field in most formats, so an array can be READY with a single online disk while width is arbitrary. The volumetric I/O path then indexes disks[] with width-derived values:

• RAID0/RAID5 ata_raid_strategy:360/:366 — drv = (blkno / interleave) % width (RAID0) → user LBA chooses drv in [0, width); :400-409 reads rdp->disks[drv].flags OOB and sets request->dev = rdp->disks[drv].dev from OOB heap → ata_raid_send_request → device_get_softc(wild).
• RAID1/01 :421-426, :441-463 — reads disks[drv + width] OOB; :581 drv += width → :585-587 request->dev = disks[width].dev (wild) and rdp->disks[width].last_lba = blkno + chunk — OOB write of a user-chosen 64-bit value at disks + width*48 + 32.
• RAID1/01 rebuild composites :504-505, :562-563 — composite->request[drv] / composite->request[this] with this = drv ± width up to 2*width-1: request[] is 32 entries (MAX_COMPOSITES), width ≥ 16 writes a kernel pointer OOB past the objcache'd ata_composite.
• ata_raid_config_changed:941-949 — RAID1/01 READY gating reads disks[disk + width] OOB at attach time.
• ata_raid_done:681-684/:743 — mirror = this ± width OOB deref.

Reproduce (this pack used the RAID0 path)

f2_width.img = FreeBSD/Promise-native metadata (vendor-independent fallback parser — any controller): RAID0, interleave=1, width=64, total_disks=1, disks[0] ONLINE, checksum valid. Boot with the disk attached:

ar0: 48MB <FreeBSD PseudoRAID RAID0 (stripe 0 KB)> status: READY
ar0: disk0 READY using ad0 at ata0-master
ar0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x80
instruction pointer = 0x8:0xffffffff8068cc00
current process = Idle
Stopped at      device_get_softc:       movq    0x80(%rdi),%rax

The kernel's own MBR slice-scan reads /dev/ar0; for blkno % 64 >= 16 the strategy computes drv >= 16, reads disks[drv].dev OOB (zeroed heap ⇒ NULL) and dereferences it: fault VA 0x80 = offsetof(struct device, softc) with dev == NULL. No user process needed — presenting the disk is enough.

Expected

Baseline: panic shown above (captured in panic.txt). Patched (fix.diff "illegal array geometry" guard in ata_raid_strategy): array still assembles but every bio fails EIO; boot completes, no fault (run.patched.log).

Files

mkmeta.py (shared builder), run.sh, panic.txt, run.patched.log, fix.diff, verdict.json.

DF-3691 VERDICT

Status: reproduced (panic; deterministic at boot from one crafted disk).

Reproduction

Crafted FreeBSD/Promise RAID0 metadata (checksum-valid, single online disk, total_disks=1, interleave=1, width=64) on ata0-master: the array assembled READY at boot (ar0: 48MB <FreeBSD PseudoRAID RAID0> status: READY), then the kernel's own slice-scan I/O drove drv = (blkno / interleave) % width = blkno % 64 past disks[15]:

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x80
current process = Idle
Stopped at device_get_softc: movq 0x80(%rdi),%rax

0x80 = offsetof(struct device, softc); %rdi = request->dev = rdp->disks[drv].dev read OOB from zeroed heap ⇒ NULL. The exact sink is sys/dev/disk/nata/ata-raid.c:400-410 (flags OOB read passes because zeros don't look PRESENT|ONLINE) → :409 request->dev = rdp->disks[request->this].dev → :410 ata_raid_send_request → device_get_softc(NULL).

Primitive characterization

• RAID0/RAID5 (demonstrated): user-selected LBA picks drv in [0,width); OOB read of a device_t at ar_softc + disks_off + drv*48 used as a pointer → wild/fake-device deref. With heap grooming this is a type-confused struct ata_device * (max_iosize/mode/unit consumed, request queued through device_get_parent(dev) chain) — an exploitation path that was not pursued to uid0 in this run (baseline heap behind ar_softc was zeros ⇒ clean NULL-deref panic).
• RAID1/RAID01 (source-proven, same root cause): OOB writes — rdp->disks[drv+width].last_lba = blkno + chunk (:567/:587, user-chosen 64-bit value at disks + width*48 + 32) and composite->request[this] = <ata_request *> (:504-505/:562-563, kernel pointer written up to request[2*width-1], array is 32). These require the OOB flags word at disks[width].flags to have AR_DF_ONLINE (heap-groom dependent), which is why the RAID0 read path was used for the deterministic demonstration.
• Width sources include a 16-bit field (Adaptec be16toh(total_disks), up to 65535 → drv up to 65534, ~3.1 MB away from disks[]).

Why READY with width=64 passes sanity checks

ata_raid_config_changed loops disk < rdp->total_disks (=1, online) for RAID0; nothing cross-checks width vs total_disks/MAX_DISKS anywhere. ata_raid_attach:157 rounds total_sectors down by interleave*width but never validates width.

Fix validation

fix.diff adds a geometry guard at the top of ata_raid_strategy (width <1 or >MAX_DISKS; RAID1/01 2*width >MAX_DISKS; RAID5 width<2 → biofinish EIO) and clamps the RAID1/01 loop in ata_raid_config_changed. Patched kernel: same disk boots, array still announced READY at attach (status logic for total_disks=1 RAID0 is unchanged), but all I/O returns EIO ("illegal array geometry (width 64)" on first request), boot completes to login, no fault. run.patched.log. fix_status = fixed.

Distinction from known findings

DF-1174/DF-2496 cover divide-by-zero from zero width/interleave. DF-1173/DF-2493/DF-2497 cover disk_number/total_disks indexing and the SPAN/JBOD walk. No prior finding covers width-driven indexing in the RAID0/1/01/5 strategy, config_changed, done, or the composite request[] writes.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.