DF-3823 — asr(4) maps the adapter-supplied FromFIFO reply offset into a kernel pointer with no validation (device-controlled arbitrary-kernel deref/write), and reads/writes MMIO at device-controlled frame offsets

• File: sys/dev/raid/asr/asr.c
• Lines: 2886-2898 (reply mapping), 2906-2953 (FAIL path MMIO offsets)
• Class: CWE-129/CWE-20 — unchecked device index → wild kernel pointer → arbitrary read/write (device-trust)
• Reach: adapter interrupt only (I2O outbound FIFO). No software path produces the value.

Analysis

asr_intr():

2886:       if (((ReplyOffset = asr_get_FromFIFO(sc)) == EMPTY_QUEUE)
2887:        && ((ReplyOffset = asr_get_FromFIFO(sc)) == EMPTY_QUEUE)) {
2888:           break;
2889:       }
2890:       Reply = (PI2O_SCSI_ERROR_REPLY_MESSAGE_FRAME)(ReplyOffset
2891:         - sc->ha_Msgs_Phys + (char *)(sc->ha_Msgs));

ReplyOffset is whatever the IOP posts in the outbound FIFO. It is assumed to lie inside the ha_Msgs reply-frame pool (contigmalloc'd at asr.c:1910-1914, ha_Msgs_Count frames), but nothing checks:

ReplyOffset >= sc->ha_Msgs_Phys
 && ReplyOffset <  sc->ha_Msgs_Phys + ha_Msgs_Count * sizeof(frame)

An offset outside that window makes Reply an arbitrary offset from the pool base — including negative (below the pool). The handler then:

• reads the 64-bit InitiatorContext64 from Reply->…StdMessageFrame (asr.c:2896-2898) and treats it as a union asr_ccb *;
• passes that pointer to ASR_ccbRemove() (asr.c:2971) which does callout_stop(&ccb->ccb_h.timeout_ch) and LIST_REMOVE — two write primitives through the forged pointer;
• writes completion status into ccb->ccb_h.status, csio.scsi_status, resid, and bcopys sense data from Reply->SenseData (asr.c:2975-3052);
• finally xpt_done(ccb) / wakeup(ccb).

In the message-failure branch (asr.c:2899-2954) it additionally uses the device-supplied PreservedMFA (MessageOffset, asr.c:2906-2908) as a bus-space offset for a 4-byte MMIO read (asr.c:2917-2921) and an MMIO write of a whole I2O_UTIL_NOP_MESSAGE (asr.c:2948-2949) — unbounded offsets into the frame BAR (device-side corruption / potential host bus faults).

Impact ceiling

With a compromised or faulty IOP, this is a full arbitrary kernel-read/write engine: choose ReplyOffset so Reply lands on controlled DMA'd memory (or anywhere in physmap), return a crafted InitiatorContext64, and ASR_ccbRemove performs unlink-style writes at the chosen address before an indirect dispatch through the CAM layer. Severity capped Low for the hardware precondition.

Verdict

inconclusive — the audit guest has no DPT/Adaptec I2O HBA (see ../DF-3825/run.log and ../DF-3819/env.txt), so asr_intr never runs. Source-level: certain.

VERDICT — DF-3823

Status: inconclusive (device-gated; the offending value is produced by the IOP's outbound FIFO. The audit guest has no asr-compatible HBA — /dev/asr0 ENOENT, zero PCI vendor-0x1044 devices — so asr_intr() never executes). Source-level confidence: certain.

Trace

1. asr_intr() reads ReplyOffset from the FromFIFO register (asr.c:2886-2888). The only value rejected is EMPTY_QUEUE (0xffffffff).
2. Reply = (frame *)(ReplyOffset - sc->ha_Msgs_Phys + (char *)sc->ha_Msgs) (asr.c:2890-2891) — pointer arithmetic on an unvalidated u32. The reply pool spans [ha_Msgs_Phys, ha_Msgs_Phys + ha_Msgs_Count * sizeof(I2O_SCSI_ERROR_REPLY_MESSAGE_FRAME)) (allocation at asr.c:1900-1915, FIFO population at asr.c:1918-1925 — every posted frame is one of these addresses, so any other value is by construction a firmware error or attack).
3. ccb = (union asr_ccb *)(long) I2O_MESSAGE_FRAME_getInitiatorContext64(&Reply->…) (asr.c:2896-2898) — 8 bytes read from wherever Reply points (the macro is a raw u_int64_t load, i2odep.h:552-555; on this driver I2O_64BIT_CONTEXT == 0 so the 64-bit context is split across InitiatorContext and the following dword — both under device control through the forged Reply).
4. ASR_ccbRemove(sc, ccb) (asr.c:2971 → 785-792): callout_stop(ccb->ccb_h.timeout_ch) — writes to the callout through the forged pointer's field; LIST_REMOVE(&ccb->ccb_h, sim_links.le) — the classic unlink arbitrary-write (fwd->back = back; back->fwd = fwd).
5. Status/resid/sense writes into the forged ccb (asr.c:2975-3052), then xpt_done(ccb) (indirect dispatch) or wakeup(ccb).
6. FAIL branch: MessageOffset = PreservedMFA from the reply (asr.c:2906-2908) is used for bus_space_read_4(..., MessageOffset + offsetof(...)) (asr.c:2917-2921) and asr_set_frame(sc, …, MessageOffset, sizeof(NOP)) (asr.c:2948-2949) — unbounded MMIO offsets into/out of the messaging BAR.

Contrast with the rest of the driver

asr_intr's sense copy (asr.c:3029-3053) does clamp its device-supplied length four ways — showing the authors clamped what they noticed; the ReplyOffset (and MessageOffset) mapping simply was never checked. The FreeBSD ancestor carries the same defect (shared-hardening).

Fix

fix.diff: reject any ReplyOffset outside the ha_Msgs pool window before forming Reply (print + break). The MessageOffset MMIO offsets additionally need a BAR-bound check — noted in the diff header; minimal fix ships the pool-window check, which kills the primary forged-Reply primitive.

Fix validation

not_testable — needs the IOP to post an out-of-window frame.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.