DF-3818 — NVMe PRP page pool exhaustion: NULL-deref / KASSERT-panic under high queue depth (unprivileged local DoS)

What

Two call sites grab a page from the fixed-size PRP pool and dereference it with only an assertion as protection:

/* mpr_build_nvme_prp() — sys/dev/raid/mpr/mpr.c:2716-2720 (ioctl path) */
prp_page_info = mpr_alloc_prp_page(sc);
KASSERT(prp_page_info != NULL, ("%s: There are no PRP Pages left ..."));
prp_page = (uint64_t *)prp_page_info->prp_page;      /* NULL deref */

/* mpr_check_pcie_native_sgl() — mpr.c:2988-2991 (I/O path) */
prp_page_info = mpr_alloc_prp_page(sc);
KASSERT(prp_page_info != NULL, ("%s: There are no PRP Pages left ..."));
curr_buff = (uint32_t *)prp_page_info->prp_page;     /* NULL deref */

The pool is fixed at NVME_QDEPTH = MPR_REQ_FRAMES = 2048 pages (mprvar.h:40,59; allocated in mpr_alloc_nvme_prp_pages(), mpr.c:1593-1631), while the command pool can hold num_reqs = MIN(max_reqframes,RequestCredit) + MIN(max_prireqframes,HighPriorityCredit) = up to 2048 + 128 = 2176 concurrent commands (mpr.c:375-381). Every NVMe-target command that needs a native SGL (mpr_data_cb() → mpr_check_pcie_native_sgl(), mpr.c:3483-3487) holds one PRP page for the command's lifetime. With ≥ 2048 such commands in flight, the 2049th mpr_alloc_prp_page() returns NULL and:

• on kernels with INVARIANTS (X86_64_GENERIC ships it, sys/config line 56): panic("mpr_check_pcie_native_sgl: There are no PRP Pages left ...");
• on kernels without: KASSERT is a no-op (sys/sys/systm.h:117) → prp_page_info->prp_page reads at offset-of-field from NULL → kernel page-fault panic.

Either way: kernel panic = local DoS.

Threat

Unprivileged users can open the raw block devices exposed for NVMe drives attached through the SAS3 controller and drive queue depth above 2048 (many threads / large async I/O chains). Requires the (supported but uncommon) NVMe-behind-MPT3 configuration. No memory corruption: pure DoS. Severity Medium per the local-DoS rubric row; confidence speculative on achievability (needs ≥2049 concurrent native-SGL NVMe I/Os), certain on the code defect.

Not runnable here

No SAS3 controller (and hence no NVMe-behind-it) on the audit guest (probe.log).

Fix

fix.diff: mpr_check_pcie_native_sgl() falls back to a normal IEEE SGL (return 1 — its existing "not built here" contract); mpr_build_nvme_prp() returns without touching NULL (the FW will reject the malformed request — degraded but non-fatal), plus a proper fix note (make it int-returning).

DF-3818 — VERDICT

status: inconclusive (runtime) — code defect certain; guest lacks both the SAS3 HBA and any NVMe device behind it.

Trace

• Pool sizing: mpr_alloc_nvme_prp_pages() mpr.c:1593-1631 allocates exactly NVME_QDEPTH (=2048) PRP pages; mpr_alloc_prp_page() (mprvar.h:545-558) returns NULL when the TAILQ is empty (and only bumps sc->prp_page_alloc_fail).
• Consumers: mpr.c:2716 (mpr_build_nvme_prp, NVMe-encapsulation ioctl path) and mpr.c:2988 (mpr_check_pcie_native_sgl, the data path for every NVMe target whose transfer needs a native SGL, entered from mpr_data_cb at mpr.c:3483-3487). Both immediately dereference with only KASSERT guarding.
• Demand ceiling: num_reqs up to 2048+128 (mpr.c:375-381) — each concurrent native-SGL NVMe I/O pins one page for its lifetime → 2049th allocation returns NULL.
• Outcome: INVARIANTS kernels (X86_64_GENERIC has options INVARIANTS) → explicit panic; non-INVARIANTS → NULL+offset read → page-fault panic (KASSERT no-op per sys/sys/systm.h:117).

Why inconclusive at runtime

Guest: driver compiled in (142 pci/mpr), no controller, no /dev/mpr*, and no NVMe device behind a SAS3 HBA (probe.log). The I/O path that grabs PRP pages is unreachable.

Impact ceiling

Unprivileged local kernel panic (DoS) on NVMe-behind-SAS3 hosts at very high queue depth. Not a corruption primitive: the failure is a fixed NULL dereference, not a controlled write.

Fix

fix.diff — graceful fallback instead of NULL deref / assert.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.