DF-3833 — stale completion after bus-reset recovery: trm_Interrupt derefs NULL pActiveDCB/pActiveSRB; trm_SRBdone walks the going list without termination

• File: sys/dev/disk/trm/trm.c (pass 2)
• Class: CWE-476 NULL deref / CWE-835 unbounded walk → kernel panic (DoS), hardware-timing-gated
• Severity: Low, speculative (needs a stale chip interrupt in a specific window; sibling path of the known DF-2524 which was trm_Disconnect's pActiveSRB)

Build / Run / Expected

Hardware-gated (env.txt: no Tekram HBA on the audit guest). Trigger on hardware: issue camcontrol reset / bus reset (XPT_RESET_BUS) or provoke an external bus reset while tagged commands are in flight; the chip raises INT_BUSSERVICE/INT_CMDDONE for an aborted command after the driver already cleared pACB->pActiveDCB.

Root cause

1. trm_Interrupt, trm.c:1337-1345: pDCB = pACB->pActiveDCB; KASSERT(pDCB != NULL, ("no active DCB")); pSRB = pDCB->pActiveSRB; <- also unchecked against NULL Windows where pActiveDCB is NULL while the chip can still signal INT_BUSSERVICE|INT_CMDDONE:
   • trm_Disconnect sets pACB->pActiveDCB = NULL (trm.c:2359) and the next command is only started later by trm_DoWaitingSRB;
   • trm_reset → trm_DoingSRB_Done completes/frees all going SRBs and clears pActiveDCB (trm.c:1184-1185) before re-enabling interrupts (1176-1178) and starting new commands;
   • trm_ScsiRstDetect clears pActiveDCB (trm.c:2805). On a GENERIC kernel (no INVARIANTS — KASSERT compiles to nothing, sys/sys/systm.h:117) a stale interrupt in that window panics at pDCB->pActiveSRB (NULL+offset read); on an INVARIANTS kernel the KASSERT fires — either way, panic.
2. trm_SRBdone, trm.c:2718-2729: if the completing SRB is not the list head, the walk while (psrb->pNextSRB != pSRB) psrb = psrb->pNextSRB; has no termination. trm_RecoverSRB (trm.c:1141-1160) moves every going SRB to the waiting list on external-reset detection, but does NOT clear pDCB->pActiveSRB; a stale completion routed through trm_Disconnect→disc1→trm_SRBdone then walks off the end of the (now empty or reordered) going list and NULL-derefs psrb->pNextSRB.

VERDICT — DF-3833

status: inconclusive (speculative, hardware-gated) — reproduced: 0 — guest impact: none.

Window analysis

1. trm_Interrupt BUSSERVICE/CMDDONE path (trm.c:1337-1350). pACB->pActiveDCB is: - cleared at trm.c:2359 in trm_Disconnect (every disconnect, before trm_DoWaitingSRB starts the next command); - cleared at trm.c:1185 in trm_reset after trm_DoingSRB_Done freed all going SRBs and after interrupts were re-enabled at trm.c:1176-1178 (EN_SCSIINTR at 3369 keeps bus-service interrupts on); - cleared at trm.c:2805 in trm_ScsiRstDetect (external reset). In any of these windows an INT_BUSSERVICE/INT_CMDDONE from the aborted command reaches pSRB = pDCB->pActiveSRB with pDCB == NULL: on X86_64_GENERIC (KASSERT compiled out, sys/sys/systm.h:117) that is a NULL-page read → panic; on INVARIANTS the KASSERT itself panics. Note pDCB->pActiveSRB is also never NULL-checked even when pDCB is valid — pActiveSRB is NULL between disc1 (trm.c:2402) and the next start.
2. trm_SRBdone unlink walk (trm.c:2718-2729). while (psrb->pNextSRB != pSRB) assumes the SRB is on the going list. trm_RecoverSRB (trm.c:1141-1160) moves all going SRBs of every DCB to their waiting lists on external-reset detection — but leaves pDCB->pActiveSRB pointing at the (now waiting-list) SRB. A subsequent stale completion routed through trm_Disconnect → disc1 → trm_SRBdone (trm.c:2397-2404) then walks past the emptied list and derefs psrb->pNextSRB with psrb == NULL.

Sibling of known DF-2524 (trm_Disconnect's own pActiveSRB deref) — this finding covers the two other members of the same stale-completion family that pass 1 did not file.

Why not reproduced

No Tekram adapter on the audit guest (env.txt); the trigger additionally requires chip-level timing (stale interrupt between reset recovery and next selection). Confidence: speculative (reachability timing-dependent), the missing checks are certain in source.

Fix

fix.diff: drop stale BUSSERVICE/CMDDONE interrupts when pActiveDCB/pActiveSRB is NULL, and make the going-list walk terminating (psrb != NULL guard + skip-unlink path). git apply --check passes.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.