DF-3898 — mps_detach_sas frees sassc after a 30-second bounded wait even if the scanner thread never exited: use-after-free

File: sys/dev/raid/mps/mps_sas.c (pass 2).

What

mps_detach_sas (sys/dev/raid/mps/mps_sas.c:783-836) shuts down the rescan thread with a bounded wait and then frees the softc unconditionally:

    if (sassc->flags & MPSSAS_SCANTHREAD) {
        sassc->flags |= MPSSAS_SHUTDOWN;
        wakeup(&sassc->ccb_scanq);

        if (sassc->flags & MPSSAS_SCANTHREAD) {
            lksleep(&sassc->flags, &sc->mps_lock, 0,
                   "mps_shutdown", 30 * hz);          /* mps_sas.c:825-826 — BOUNDED */
        }
    }
    mps_unlock(sc);

    kfree(sassc->targets, M_MPT2);                     /* mps_sas.c:831 */
    kfree(sassc, M_MPT2);                              /* mps_sas.c:832 — even if thread alive */

The scanner thread (mpssas_scanner_thread, mps_sas.c:2885-2924) exits only when it observes MPSSAS_SHUTDOWN — checked after its 1-second sleep and after each xpt_action(ccb) (mps_sas.c:2900-2915). An XPT_SCAN_BUS dispatched to this sim performs synchronous CAM probes of every target/LUN; with devices in error recovery (60 s timeouts, 4 retries per LUN — cf. mpssas_check_eedp's own 60 s/4-retry CCBs at mps_sas.c:3128-3130) one scan leg can far exceed 30 s. When it does:

• lksleep times out, detach proceeds, sassc->targets and sassc are freed (and cam_sim_free(sassc->sim) already ran at mps_sas.c:817);
• the still-running thread then executes xpt_action → mpssas_action(sim, ccb) → sassc = cam_sim_softc(sim) (freed sim), dereferences sassc->sc, sassc->targets[...], TAILQ_REMOVE on sassc->ccb_scanq (mps_sas.c:2906-2910), and on exit writes sassc->flags &= ~MPSSAS_SCANTHREAD + wakeup(&sassc->flags) (mps_sas.c:2919-2920) — use-after-free reads and writes on kmalloc'd memory.

Trigger path: device detach / kldunload/driver reprobe while the bus scan is stuck on wedged targets — i.e. exactly the failing-enclosure scenario detach is used to recover from. Requires privilege (root performs detach), hence Low.

Build/run

run.sh records the hardware gate.

Fix

If MPSSAS_SCANTHREAD is still set after the bounded sleep, do not free — leak the softc (and warn) instead of converting a stuck scan into a UAF (fix.diff).

DF-3898 — VERDICT

Status: not_reproduced (hardware-gated) — defect certain from source; trigger requires privileged detach + a >30 s scan leg. Impact class: use-after-free (kernel memory corruption) on kldunload — Low (privileged trigger).

Proof chain

1. sys/dev/raid/mps/mps_sas.c:820-828 — detach requests MPSSAS_SHUTDOWN and waits a maximum of 30 s (lksleep(..., 30 * hz)).
2. sys/dev/raid/mps/mps_sas.c:2897-2917 — the scanner thread checks the flag only (a) after each 1 s lksleep and (b) after xpt_action(ccb) returns. xpt_action on an XPT_SCAN_BUS ccb executes synchronous CAM probes through mpssas_action for every target/LUN; device-side error recovery uses 60 s CCB timeouts with retries (the driver's own internal EEDP probe CCBs are 60 s × 4 retries, mps_sas.c:3128-3130), so a scan over wedged targets can run minutes.
3. sys/dev/raid/mps/mps_sas.c:829-833 — after the bounded sleep the function unconditionally executes kfree(sassc->targets) and kfree(sassc) (and cam_sim_free(sassc->sim) already happened at mps_sas.c:815-818) regardless of MPSSAS_SCANTHREAD still being set.
4. UAF sites in the still-alive thread: cam_sim_softc(sim) use (mps_sas.c:897 via mpssas_action), TAILQ_REMOVE(&sassc->ccb_scanq, ...), xpt_action (mps_sas.c:2906-2911), and the exit path's write sassc->flags &= ~MPSSAS_SCANTHREAD; wakeup(&sassc->flags) (mps_sas.c:2919-2920) — freed-memory writes, i.e. genuine UAF, not just a hang.

Why not reproduced

Guest has no mps HBA (env.txt/run.log), so neither the thread nor a scan exists; additionally the trigger needs a privileged detach. Source sequence is complete and unconditional once the 30 s bound is exceeded.

Fix validation

Not testable here. fix.diff converts the overrun case into a warned leak (strictly better than UAF); the fully-correct upstream fix would make the thread exit wait unbounded or cancel the in-flight scan.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.