DF-3692 — RAID ioctls index ata_raid_arrays[lun] with an unvalidated int

Root cause (source)

The RAID ioctl dispatch (sys/dev/disk/nata/ata-raid.c:241-270, chained from ata_ioctl in ata-all.c:443-444) passes the user-supplied int lun straight into ata_raid_arrays[MAX_ARRAYS] (16 pointers, kernel .bss):

1008:  if (!(rdp = ata_raid_arrays[status->lun]))     /* IOCATARAIDSTATUS   */
1287:  if (!(rdp = ata_raid_arrays[array]))           /* IOCATARAIDDELETE   */
1323:  if (!(rdp = ata_raid_arrays[config->lun]))     /* IOCATARAIDADDSPARE */
1373:  if (!(rdp = ata_raid_arrays[array]))           /* IOCATARAIDREBUILD  */

No < 0 || >= MAX_ARRAYS check anywhere. A wild struct ar_softc * is then dereferenced; depending on the subcommand: - STATUS: fields of the wild object are copied back to userspace (kernleak) and device_get_unit(rdp->disks[i].dev) walks wild device pointers; - REBUILD: rdp->status |= AR_S_REBUILDING / rdp->rebuild_lba = 0 — writes through the wild pointer; - DELETE: disk_destroy(), devstat_remove_entry(), kfree(rdp, M_AR) on the wild pointer — arbitrary free.

DF-2495 (known) covers the total_disks loop overflows in CREATE/STATUS; the unbounded lun index into the global pointer table is a distinct, previously unreported defect.

Reproduce

cc -O -o f3_ioctl_lun f3_ioctl_lun.c
./f3_ioctl_lun status 0        # baseline: "Device not configured" (ENXIO)
./f3_ioctl_lun rebuild 134217728   # lun = 0x8000000 -> +1 GiB OOB

Expected (baseline, unpatched)

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0xffffffffc114dec0
fault code      = supervisor read data, page not present
Stopped at      ata_raid_ioctl+0x154:   movq    ata_raid_arrays(,%rax,8),%rcx

(fault VA == &ata_raid_arrays[0x8000000]; ssh dies, guest wedged in DDB.)

With fix.diff applied the same call returns EINVAL, no fault.

Reachability

/dev/ata is root-owned (0600 root:operator on this guest), so the ioctl family is privileged (root, or operator where devfs is permissive — the same privilege class DF-2495 already documented for this device). Impact is kernel memory corruption from a sanctioned management interface (incl. jail scenarios where /dev/ata is exposed).

Files

f3_ioctl_lun.c, panic.txt, run.patched.log, fix.diff, verdict.json

DF-3692 VERDICT

Status: reproduced (panic in the ioctl dispatcher; arbitrary-index OOB read of a kernel pointer table).

Reproduction

Guest: DragonFly 6.5-DEVELOPMENT X86_64_GENERIC (ataraid compiled in, so ata_raid_ioctl_func is live without kldload). /dev/ata is 0600 root:operator → run as root.

/tmp/poc/f3_ioctl_lun status 0          -> "status ioctl: Device not configured" (ENXIO, in-bounds)
/tmp/poc/f3_ioctl_lun rebuild 134217728 -> (no reply; ssh dies)

Serial console:

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xffffffffc114dec0
fault code = supervisor read data, page not present
current process = 5424
Stopped at ata_raid_ioctl+0x154: movq ata_raid_arrays(,%rax,8),%rcx

0xffffffffc114dec0 - 8*0x8000000 = 0xffffffff8114dec0 = &ata_raid_arrays[0] — the fault is the OOB table read itself (the dispatch was inlined into ata_raid_ioctl). Guest wedged in DDB.

Primitive characterization

• Demonstrated: controlled-index OOB read of kernel .bss → fatal fault (panic / persistent DoS of the management path).
• Same primitive with adjacent (mapped) indexes yields a content-derived struct ar_softc * that STATUS copies fields out of to userspace (two-level kernel-memory disclosure), REBUILD writes through (status |= 0x4, rebuild_lba = 0), and DELETE kfrees — arbitrary free. These variants are source-certain but were not individually exercised (they depend on what pointer value happens to sit at the chosen slot; on this no-KASLR guest ata_raid_arrays is at 0xffffffff8114dec0 and slots 16+ are other kernel data). Root-gated (see README), hence Medium.

Fix validation

fix.diff adds < 0 || >= MAX_ARRAYS guards for the lun/array index in all four subcommands (STATUS/DELETE/ADDSPARE/REBUILD). Patched kernel: rebuild 134217728 → rebuild ioctl: Invalid argument, guest stays up (run.patched.log). fix_status = fixed.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.