DF-3729 — ciss_notify_rescan_logical: unbounded ndrives + unchecked LUN_TO_BUS/TARGET → OOB heap read and write

File: sys/dev/raid/ciss/ciss.c:3866 (ndrives from the controller-written list_size, no CISS_MAX_LOGICAL sanity check — unlike ciss_init_logical at ciss.c:1357) and ciss.c:3896-3912 (cll->lun[i] read past the 15-LUN report buffer; ciss_logical[bus][target] indexed with bus∈[0,255] / target∈[0,255] against rows= ciss_max_logical_bus (typically 1-2) × columns CISS_MAX_LOGICAL=15).

Class: kernel heap OOB read feeding OOB writes (CWE-125/CWE-787), firmware-data-driven. Upstream-inherited (FreeBSD has the same walk); the pass-1 set (DF-1190) fixed only the attach-time sibling.

Reproduce

./build.sh && ./run.sh

Expected output

Baseline: 226 OOB reads past the report buffer and 226 OOB row/col index computations, [BUG REPRODUCED]. Fixed replica (-DFIXED = clamp ndrives to CISS_MAX_LOGICAL + validate bus/target): [FIXED] ... 0 OOB accesses.

Trigger (kernel)

A CISS_NOTIFY_LOGICAL/status-change (or media-exchange) event makes ciss_notify_logical call ciss_notify_rescan_logical (ciss.c:3960/3973), which issues REPORT_LOGICAL_LUNS into a 15-LUN buffer and walks the firmware-supplied list_size. A malicious or buggy controller reply (list_size larger than the buffer, and/or LUN addresses encoding bus/target outside the arrays — cissreg.h:509-510) produces the OOB accesses; the driver then WRITES through the OOB ld (cl_update, cl_address, cl_controller; ciss_identify_logical stores kmalloc pointers into cl_ldrive/cl_lstatus).

Fix

fix.diff (two hunks: clamp + bounds check, mirroring ciss.c:1357's established pattern). Compile-validated with the other 6 ciss fixes at -Werror (fix_build.log); behaviorally validated by the -DFIXED run.

Artifacts

VERDICT.md, harness.c, build.sh, run.sh, build.log, run.log, run.2.log, run.3.log, env.txt, fix.diff, fix_apply.log, fix_build.log, manifest.json, verdict.json.

DF-3729 VERDICT

Finding

ciss_notify_rescan_logical() (sys/dev/raid/ciss/ciss.c:3851-3914) is the event-driven sibling of ciss_init_logical(). Where the attach-time path validates the controller reply:

    /* ciss.c:1356-1362 (init_logical — HAS the check) */
    ndrives = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
    if ((ndrives < 0) || (ndrives > CISS_MAX_LOGICAL)) { ... ENXIO }

the notify path has none of it:

    /* ciss.c:3866 (notify_rescan_logical — NO check) */
    ndrives = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
    ...
    /* ciss.c:3896-3912 */
    for (i = 0; i < ndrives; i++) {
        bus   = CISS_LUN_TO_BUS(cll->lun[i].logical.lun);      /* 0..255 */
        target = CISS_LUN_TO_TARGET(cll->lun[i].logical.lun);  /* 0..255 */
        ld    = &sc->ciss_logical[bus][target];    /* rows: ciss_max_logical_bus
                                                      (min 2), cols: 15 */
        ...
        ld->cl_update     = 0;                     /* OOB WRITE */
        ld->cl_address    = cll->lun[i];           /* OOB WRITE */
        ld->cl_controller = &sc->ciss_controllers[bus]; /* OOB read + OOB store */
        if (ciss_identify_logical(sc, ld) == 0)    /* stores kmalloc'd
                                                      cl_ldrive/cl_lstatus
                                                      pointers OOB */

cll was kmalloc'd for exactly sizeof(*cll) + CISS_MAX_LOGICAL*8 bytes (ciss.c:1270 via ciss_report_luns(..., CISS_MAX_LOGICAL)), so a firmware list_size claiming more than 15 LUNs makes cll->lun[i] an OOB heap read past the allocation, and the derived bus/target (cissreg.h:509-510) index ciss_logical up to 255 rows / 255 columns out of bounds → OOB writes at 2 * sizeof(void*)-ish granularity plus ciss_identify_logical's pointer stores — an arbitrary-offset heap write primitive relative to the ciss_logical row array, fully firmware-chosen.

FreeBSD's ciss_notify_rescan_logical (upstream ciss.c:3967-4030) has the identical unbounded walk — this is an upstream-inherited defect; the pass-1 audit (DF-1190) fixed only the attach-time copy of the pattern.

Reachability

ciss_notify_logical (ciss.c:3960, 3973) calls this on every logical-drive status-change / media-exchange notify event, i.e. whenever the adapter reconfigures volumes — remote/MSA failover, drive insertion, firmware-initiated rescan. The notify event data itself is firmware-supplied (and its bus/target are separately unbounded — that part is the known DF-1189); this finding is the rescan table walk the known set missed.

Verification (no HP Smart Array on the audit guest)

harness.c replicates the walk with a redzone-backed 128-byte report buffer and a 2-row/15-col logical table: - baseline (run.log, stable in run.2/run.3): with list_size = 0x1000 (4096 LUNs claimed), iterations ≥15 read the redzone (raw 0xffffffff) and compute bus=255 target=255 → 226 OOB reads + 226 OOB index computations → [BUG REPRODUCED]; - -DFIXED replica (clamp + bounds check): [FIXED] ... 0 OOB accesses.

Fix validation

• fix.diff: hunk 1 clamps ndrives exactly like ciss.c:1357 (plus frees cll and returns); hunk 2 rejects out-of-range bus/target entries.
• fix_apply.log: clean dry-run; fix_build.log: ciss.ko rebuilt with all 7 ciss pass-2 fixes at -Werror, link rc=0.
• Harness -DFIXED run: 0 OOB accesses.

Bottom line: reproduced (harness-level, firmware-gated path); unbounded firmware-controlled heap read + write in the notify rescan walk; fix validated at compile + replica level.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.