⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-4011

COMPAT_FREEBSD32 shim is un-compilable dead code (undefined com/td, 5-arg mpr_ioctl call); native RAID_ACTION ioctl referenced but unimplemented

Summary

mpr_ioctl_devsw calls mpr_ioctl32 with com and td undefined, and mpr_ioctl32 calls the 4-arg mpr_ioctl with 5 arguments; DragonFly never defines COMPAT_FREEBSD32 so the block never builds. The shim maps MPRIO_RAID_ACTION32 to a native ioctl the switch does not implement (ENOIOCTL) - the RAID-action surface is dead, which also answers the checklist: no RAID-action buffer-sizing bug exists because no handler exists. Delete-or-port fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-4011 · 2 files
FileTypeDescriptionSize
README.md readme analysis + fix sketch 1.9 KB ↓ raw
verdict.json verdict machine verdict 1.9 KB view raw
README.md readme analysis + fix sketch
↓ download raw

DF-4011 — mpr_user.c COMPAT_FREEBSD32 block is dead, un-compilable code; native RAID_ACTION ioctl referenced only by the dead shim

What

sys/dev/raid/mpr/mpr_user.c:2425-2604 (#ifdef COMPAT_FREEBSD32) cannot compile and is not compiled anywhere in the tree:

  1. mpr_ioctl_devsw (mpr_user.c:2606-2619) calls mpr_ioctl32(dev, com, arg, flag, td) — com and td are undefined identifiers in that scope (the function's parameters are ap->a_cmd/no td at all).
  2. mpr_ioctl32 itself calls mpr_ioctl(dev, cmd, &arg, flag, td) with 5 arguments; mpr_ioctl takes 4 (mpr_user.c:2258-2259).

  3. DragonFly does not define COMPAT_FREEBSD32 in any kernel config (the 32-bit-compat layer this shim was written for was FreeBSD's), so the block never builds — these are latent compile-time defects, not runtime bugs.

  4. The shim maps MPRIO_RAID_ACTION32 → native MPRIO_RAID_ACTION (mpr_user.c:2523-2537), but the native mpr_ioctl() switch (mpr_user.c:2272-2417) has no MPRIO_RAID_ACTION case at all — it would fall to default: ENOIOCTL. The RAID-action ioctl surface exists in the header (mpr_ioctl.h:101-114,362) and in the 32-bit struct copy, but has no implementation. (This also answers the pass-2 checklist item "(d) RAID action ioctls": there is no buffer-sizing bug because there is no handler — struct mpr_raid_action is dead weight.)

Impact

Info / latent: zero runtime impact as shipped (the ifdef is never defined), but (a) anyone re-enabling COMPAT_FREEBSD32 gets an immediate build break rather than a silent mis-build, and (b) the missing RAID_ACTION handler documents a feature gap that tools ported from FreeBSD may expect.

Fix sketch

Delete the COMPAT_FREEBSD32 block (or port it properly: com→cmd, drop td, fix the 5-arg call, and drop or implement the RAID_ACTION mapping). Recorded as Info; no PoC needed.

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

not applicable (Info)

per-fix-DF-4011

Confirmed kernel references

Detail

Evidence (decisive lines)

mpr_user.c:2614-2617 (undefined com/td), mpr_user.c:2553 (5-arg call into 4-arg mpr_ioctl at :2258), mpr_user.c:2272-2417 (no RAID_ACTION case), mpr_ioctl.h:362

PoC changes

n/a

Verified recommended fix

Remove the COMPAT_FREEBSD32 block (or fix it: com->cmd, drop td, correct the mpr_ioctl arity, and drop the RAID_ACTION mapping until a native handler exists).

Verdict

Info-level latent defect, no runtime impact as shipped: the COMPAT_FREEBSD32 block (mpr_user.c:2425-2604) references undefined identifiers (com, td in mpr_ioctl_devsw at :2616) and calls the 4-arg mpr_ioctl with 5 arguments (:2553), so it cannot compile — DragonFly never defines COMPAT_FREEBSD32. The shim's MPRIO_RAID_ACTION32 maps to native MPRIO_RAID_ACTION which the native ioctl switch does not implement (falls to ENOIOCTL) — the RAID-action ioctl surface (mpr_ioctl.h:101-114,362) is dead. Pass-2 checklist item (d) answered: no RAID-action buffer-sizing bug exists because no handler exists.