DF-3731 — XPT_PATH_INQ max_target off-by-one: CAM probes target 15 into the 15-entry ciss_logical rows

File: sys/dev/raid/ciss/ciss.c:2956 (cpi->max_target = CISS_MAX_LOGICAL; = 15) vs row allocation of exactly CISS_MAX_LOGICAL entries, indices 0..14 (ciss.c:1377-1379). CAM's bus scan iterates for (i = 0; i <= max_target; i++) — INCLUSIVE (sys/bus/cam/cam_xpt.c:5382), so target 15 is probed on every scan and sc->ciss_logical[bus][15].cl_status is read one struct past the row allocation (ciss_cam_emulate, ciss.c:3159; XPT_CALC_GEOMETRY, ciss.c:2923).

Class: recurring heap OOB read (CWE-125) on every bus scan/boot; heap-layout-dependent deeper impact (garbage ONLINE → wild cl_ldrive/cl_lstatus deref in ciss_cam_complete_fixup, ciss.c:3321-3325). Distinct from DF-1194 (that one is the bus-row <= in init/free; this one is the target-column off-by-one against CAM's inclusive scan).

Reproduce

./build.sh && ./run.sh

Expected output

Baseline: probe target 15: read ciss_logical[0][15].cl_status ... <== OOB and [BUG REPRODUCED] 1 OOB read(s). Fixed replica (-DFIXED = max_target = CISS_MAX_LOGICAL - 1): all probes in bounds.

Fix

fix.diff (one line). Compile-validated with the other 6 ciss fixes at -Werror (fix_build.log); behaviorally validated by the -DFIXED run.

Artifacts

VERDICT.md, harness.c, build.sh, run.sh, build.log, run.log, run.2.log, run.3.log, env.txt, fix.diff, fix_apply.log, fix_build.log, manifest.json, verdict.json.

DF-3731 VERDICT

Finding

ciss_cam_action(XPT_PATH_INQ) advertises

    /* sys/dev/raid/ciss/ciss.c:2956 */
    cpi->max_target = CISS_MAX_LOGICAL;      /* 15 */

but each sc->ciss_logical[bus] row is allocated with exactly CISS_MAX_LOGICAL entries (ciss.c:1377-1379) — valid indices 0..14, with target 15 being the driver's own initiator_id (ciss.c:2958). CAM semantics treat max_target as INCLUSIVE: the bus scan is

    /* sys/bus/cam/cam_xpt.c:5382 */
    for (i = 0; i <= max_target; i++)

so every rescan probes target 15, and the SIM reads

• sc->ciss_logical[bus][15].cl_status in ciss_cam_emulate (ciss.c:3159),
• sc->ciss_logical[bus][target] in XPT_CALC_GEOMETRY (ciss.c:2923),

one struct ciss_ldrive past the row kmalloc — a recurring heap OOB read executed at every boot/rescan on every machine with this controller.

Impact ceiling (speculative, heap-layout dependent)

If the adjacent heap object happens to contain CISS_LD_ONLINE (1) at the cl_status offset of the phantom row, the probe proceeds to real I/O and ciss_cam_complete_fixup (ciss.c:3321-3325) dereferences the phantom row's cl_ldrive/cl_lstatus garbage pointers. With kmalloc(..., M_ZERO) neighbours the value is 0 (NONEXISTENT → clean SEL_TIMEOUT), so the observable effect is normally benign — hence Low severity with the OOB read itself certain.

Verification (no HP Smart Array on the audit guest)

harness.c models the inclusive CAM scan over a canary-backed 15-entry row: - baseline (run.log, stable in run.2/run.3): probe target 15 ... <== OOB, [BUG REPRODUCED] 1 OOB read(s); - -DFIXED (max_target = CISS_MAX_LOGICAL - 1): 15 probes, all in bounds.

Fix validation

• fix.diff: cpi->max_target = CISS_MAX_LOGICAL - 1;
• fix_apply.log: clean dry-run; fix_build.log: ciss.ko rebuilt with all 7 ciss fixes at -Werror, link rc=0; -DFIXED harness run clean.

Bottom line: reproduced (harness-level); certain recurring OOB read, speculative deeper impact; fix validated at compile + replica level.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.