DF-3830 — trm_detach frees live DMA/bus resources before tearing down the interrupt and deregistering the SIM

• File: sys/dev/disk/trm/trm.c (pass 2)
• Class: CWE-99 / CWE-416 (use-after-free via improper shutdown ordering), missing queue drain
• Severity: Low (trigger requires root kldunload trm.ko — module not in GENERIC — or physical PCI hot-removal of a Tekram DC395U/U2 adapter while I/O is in flight)

Build / Run / Expected

Not runnable on the audit guest: no Tekram PCI device (see env.txt); trm_probe() only matches 0x03911DE1/0x03921DE1, so the driver never attaches and trm_detach is unreachable there. On hardware, the trigger is:

kldload trm.ko            # card present, disk busy (dd if=/dev/daX of=/dev/null bs=1m)
kldunload trm.ko          # trm_detach runs with SRBs in flight

Expected on vulnerable code: interrupt storm / kernel panic (NULL or freed pACB->pFreeSRB, pSRB->pccb), or leaked CCBs wedging the CAM queue — any of which constitutes the UAF.

Root cause (order of operations in trm_detach, trm.c:3692-3716)

1. bus_release_resource(dev, SYS_RES_IOPORT, ...) — trm.c:3696 — I/O port region RELEASED FIRST, while pACB->irq is still installed. Any interrupt between here and bus_teardown_intr (trm.c:3710) makes trm_Interrupt do bus_space_read/write on a released region.
2. trm_destroySRB(pACB) — trm.c:3697 — frees SG lists and pSRB->dmamap for only the SRBs on pACB->pFreeSRB (trm.c:2999-3015). SRBs sitting on per-target pWaitingSRB/pGoingSRB lists and the active pActiveSRB are NOT visited: their maps leak and — worse —
3. bus_dmamem_free(pACB->srb_dmat, pACB->pFreeSRB, ...) — trm.c:3700 — frees the entire 256-entry SRB array that those in-flight CCBs still reference (ccb_h.ccb_trmsrb_ptr), while their pccbs are never xpt_done'd (no drain, no freeze).
4. Only afterwards: bus_teardown_intr (3710), then xpt_bus_deregister/cam_sim_free (3714-3715). Until then CAM still owns a registered SIM whose trm_action can be invoked concurrently against freed softc state (pACB->pFreeSRB now dangling, dma tags destroyed at 3698/3703/3708/3709 before the SIM that uses them is gone).

Contrast with trm_attach's own error path (trm.c:3631-3665) which at least tears down in the sensible order (no interrupt/DMA race there because the SIM was never registered on failure).

Fix

Reorder trm_detach: deregister the SIM first (after flushing), tear down the interrupt second, release DMA memory third, I/O port last. See fix.diff.

VERDICT — DF-3830

status: inconclusive (source-certain, hardware-gated) — reproduced: 0 — impact demonstrated on guest: none (confirmed impact class on hardware: UAF/panic/wedge; not exercised — no Tekram HBA on the audit guest, env.txt).

Why this is a real defect (line-cited trace)

trm_detach (sys/dev/disk/trm/trm.c:3692-3716) executes, in this order:

There is no xpt_freeze_simq, no drain of going/waiting SRBs, no completion of outstanding CCBs — compare FreeBSD's later trm(4), and the driver's own attach-failure path which never has the SIM registered while freeing (trm.c:3631-3665).

Reachability

• trm is not in X86_64_GENERIC; it is a KLD (sys/dev/disk/trm/Makefile). Trigger: root kldunload trm.ko with I/O in flight, or surprise hot-removal of the PCI card.
• Root-only / physical → severity Low, but the primitive is a straight UAF of the 128 KiB SRB array (TRM_MAX_SRB_CNT * sizeof(TRM_SRB), trm.c:3441-3456) plus unmapped-MMIO ISR execution.
• Guest: pciconf -l shows 7 devices, none with vendor 0x1DE1 (env.txt) → trm_probe (trm.c:3677-3688) returns ENXIO, driver never attaches, trm_detach unreachable. Hence inconclusive rather than reproduced.

Fix validation

fix.diff reorders detach into: flush+deregister SIM → teardown IRQ → free SRB DMA → free sense → destroy tags → release I/O port, and drains going/waiting lists (complete with CAM_UNEXP_BUSFREE, recycle SRB) before freeing the array. Not exercisable on this guest (no hardware); compiles-by-inspection against the current tree only.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.