DF-3774 — ahci_set_feature() / ahci_read_log(): unchecked NULL from ahci_ata_get_xfer() → NULL-pointer kernel panic under CCB-pool exhaustion

File: sys/dev/disk/ahci/ahci.c (pass 2, GLM 5.3)

What the bug is

ahci_ata_get_xfer() (ahci.c:3669-3689) returns NULL when the per-port CCB free list is empty (ahci_get_ccb() → NULL). Two ahci.c callers never check:

int
ahci_set_feature(struct ahci_port *ap, struct ata_port *atx, ...)
{
    ...
    xa = ahci_ata_get_xfer(ap, atx);     /* ahci.c:4057 */
    xa->fis->type = ATA_FIS_TYPE_H2D;    /* ahci.c:4059 — NULL deref */
    ...
}

int
ahci_read_log(struct ahci_port *ap, struct ata_port *atx, ...)
{
    ...
    xa = ahci_ata_get_xfer(ap, atx);     /* ahci.c:4090 */
    xa->fis->type = ATA_FIS_TYPE_H2D;    /* ahci.c:4092 — NULL deref */
    ...
}

fis is the first member of struct ata_xfer (atascsi.h:356-358), so the fault is a read of *(NULL + 0) → kernel panic.

This is the same defect class already filed for the sibling files: DF-2420 (ahci_cam.c dispatch sites) and DF-2423 (ahci_pm_read/write). These two ahci.c sites were not covered by either record.

Reachability

The CCB pool is sc_ncmds - 1 deep (slot 1 is the reserved error CCB, ahci.c:431-439) and CAM's devq is sized to exactly sc_ncmds - 1 openings (ahci_cam.c:111-115), so ordinary CAM I/O alone can hold every free CCB — in particular CCBs in the window where ahci_xpt_scsi_*_io() has taken a CCB (ahci_cam.c:1082/1524, under ap_sim_lock only) but is blocked in ahci_ata_cmd() on the port lock.

• ahci_read_log is called from ahci_cam_probe_disk() (ahci_cam.c:605, DevSleep identify support) during (re)probe, which runs while the port lock is held for seconds (PM probe sleeps 5s) — CAM submissions from other CPUs can hold all free CCBs in that window → NULL deref.
• ahci_set_feature is called from ahci_port_link_pwr_mgmt() (ahci.c:634, 641, 688, 695, 718, 721 — sysctl hw.ahci.X.link_pwr_mgmt, root-gated) and from DIPM/APST negotiation.

Impact: NULL-deref panic (local DoS). Combined severity capped at Low for this file's sites (probe-path variant is hotplug/PM-conditioned; sysctl variant is root-gated) — see DF-2420/2423 for the class discussion.

Why not reproduced on the guest

No AHCI controller on the audit guest (env.txt); the probe/link-pm paths cannot execute. Class precedent (DF-2420) documents the exhaustion mechanics.

DF-3774 VERDICT — not_reproduced (no AHCI hardware on guest); NULL-deref sites certain by source

Bottom line

ahci_set_feature() (ahci.c:4047-4077) and ahci_read_log() (ahci.c:4080-4115) call ahci_ata_get_xfer() (ahci.c:3669-3689) and immediately dereference the result (xa->fis->type = ... at ahci.c:4059 and ahci.c:4092) without a NULL check. ahci_ata_get_xfer() returns NULL whenever the per-port free-CCB list is empty. fis is the first field of struct ata_xfer (atascsi.h:356-358), so a NULL xa faults on the next line — kernel panic.

Pool-exhaustion is reachable because CAM's devq has exactly sc_ncmds - 1 openings (ahci_cam.c:111-115) matching the sc_ncmds - 1 free CCBs (slot 1 reserved, ahci.c:431-439): a burst of submissions grabs all free CCBs under ap_sim_lock (ahci_cam.c:1082/1524) and holds them while blocked on the port lock. ahci_read_log runs from ahci_cam_probe_disk() (ahci_cam.c:605) during probe — which holds the port lock for seconds during PM probing — and ahci_set_feature runs from the hw.ahci.X.link_pwr_mgmt sysctl (ahci_dragonfly.c:150-162 → ahci.c:595-752) and DIPM negotiation.

Same class as DF-2420 (ahci_cam.c) and DF-2423 (ahci_pm.c); those records cover their files' sites, these are the two unfiled ahci.c sites.

Not-reproduced rationale

Guest has no AHCI controller (env.txt) — neither probe nor link-pm paths can run. NULL-deref on exhaustion is certain from source; runtime frequency depends on I/O concurrency (documented for the class in DF-2420).

Recommended fix

Check for NULL and return EBUSSE/EIO:

    xa = ahci_ata_get_xfer(ap, atx);
    if (xa == NULL)
        return (EBUSY);     /* or EIO for read_log */

see fix.diff.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.