DF-4086 — _mapping_get_ir_maprange off-by-one: end_idx == max_devices → OOB read + conditional 32-byte OOB write of mapping_table[]

File: sys/dev/raid/mps/mps_mapping.c (range calc :221-235; OOB sinks :366, :409, :457/:462, write :2222-2232, secondary :1647, :2126-2129) Class: CWE-191 integer underflow/off-by-one → CWE-125 read + CWE-787 write Severity: High — pass 2 (GLM 5.3), bucket memcorrupt Fresh pass-2 finding (not DF-1374: no DPM DeviceIndex involved; not DF-1375: no slot arithmetic; the mpr sibling checklist DF-3914..3919 does not cover it either — verified against the findings DB).

The bug (source-confirmed)

/* mps_mapping.c:221-235 */
if (volume_mapping_flags == MPI2_IOCPAGE8_IRFLAGS_LOW_VOLUME_MAPPING) {
        *start_idx = 0;
        if (ioc_pg8_flags & MPI2_IOCPAGE8_FLAGS_RESERVED_TARGETID_0)
                *start_idx = 1;
} else
        *start_idx = sc->max_devices - sc->max_volumes;
*end_idx = *start_idx + sc->max_volumes - 1;          /* <-- unclamped */

max_devices = facts->MaxTargets + facts->MaxVolumes (:1734). If the IOC facts report MaxTargets == 0 while IOC pg8 sets RESERVED_TARGETID_0 and low volume mapping (all firmware-controlled), then start_idx = 1, max_devices = max_volumes, and

end_idx = 1 + max_volumes - 1 == max_devices     /* one past last index */

Every IR walk in the file uses inclusive <= against end_idx:

The write is reached whenever _mapping_get_free_ir_mt_idx returns the OOB index (table entries all in use, adjacent heap garbage without the IN_USE bit) — then a RAID-volume IR config-change event (firmware-sourced) writes one dev_mapping_table entry immediately past the kmalloc(max_devices*32) allocation. Heap-adjacent corruption with mostly controlled contents; on the intentionally permissive audit guest this is classic slab-neighbor overwrite material.

The high-volume-mapping branch (start = max_devices - max_volumes, end = max_devices - 1) is always in bounds; the bug needs the low-mapping + reserved + MaxTargets == 0 combination, all in one firmware image.

Reproduction (object-level, hardware-gated)

No mps HBA in the audit guest (env.txt). harness_df4086.c replicates the range function, the <= walks and the event write verbatim:

cc -O2 -Wall -o harness_df4086 harness_df4086.c && ./harness_df4086

Decisive output (run.log, stable in run.2.log):

facts: MaxTargets=0 MaxVolumes=255 -> max_devices=255
IR maprange: start=1 end=255  (end == max_devices => OFF-BY-ONE: `<=` walks hit index 255)
wwid walk  :366 read physical_id at mapping_table[255] -> OOB READ
free-idx walk :457 returned 255 (== max_devices, OUT OF BOUNDS)
event write: mapping_table[255] = {wwid 0x57119418badb00b5, handle 0x0b1d, info 0x30000000}
guard[0].physical_id == fw WWID: 32-byte heap OOB WRITE at index max_devices
RESULT: OFF-BY-ONE OOB READ + CONDITIONAL OOB WRITE PROVEN

Fix

fix.diff — clamp *end_idx to max_devices - 1 in _mapping_get_ir_maprange() so all <= walks stay in bounds regardless of firmware facts. Compile-validated with the rest of this batch's mps fixes (-Werror, mps.ko linked — fix_build.log).

DF-4086 VERDICT

Status: not_reproduced (kernel level) — hardware-gated; off-by-one read + conditional OOB write proven at object level on the audit guest. Confidence: certain (arithmetic + sinks traced line-by-line).

Why end_idx can equal max_devices

• mps_mapping.c:1734 sc->max_devices = sc->facts->MaxTargets + sc->max_volumes; (MaxTargets: U16 IOC facts mpi2_ioc.h:275; MaxVolumes: U8 mpi2_ioc.h:282).
• :1746-1747 num_rsvd_entries = 1 when pg8 RESERVED_TARGETID_0.
• :221-235 _mapping_get_ir_maprange(): low-volume-mapping ⇒ start_idx = 1 (reserved), end_idx = start_idx + max_volumes - 1.
• With MaxTargets == 0: max_devices == max_volumes ⇒ end_idx == max_devices — the loops below run map_idx <= end_idx and touch mapping_table[max_devices], one entry (32 bytes) past the kmalloc(max_devices * 32) (:1393-1394) allocation.

All four inputs (MaxTargets, IR capability, volume-mapping mode, reserved-id flag) come from the IOC firmware/pci-attached device; nothing clamps the range.

Sinks verified in source

1. _mapping_get_ir_mt_idx_from_wwid :364-368 — for (map_idx = start_idx; map_idx <= end_idx; map_idx++, mt_entry++) if (mt_entry->physical_id == wwid) → OOB read; if adjacent-heap garbage equals the WWID (fw can retry WWIDs), the returned index flows to :2174-2179 (mt_entry->device_info |= MPS_MAP_IN_USE — OOB read-modify-write).
2. _mapping_get_ir_mt_idx_from_handle :407-411 — same, on dev_handle.
3. _mapping_get_free_ir_mt_idx :456-468 — first pass returns the first index whose device_info lacks MPS_MAP_IN_USE; at map_idx == max_devices that is adjacent-heap memory → returns an OOB index. Second pass can equally return it via missing_count (OOB read).
4. mps_mapping_ir_config_change_event :2206-2232 — on volume ADDED / VOLUME_CREATED with no matching WWID: map_idx = _mapping_get_free_ir_mt_idx(sc); ... mt_entry = &sc->mapping_table[map_idx]; then writes physical_id (WWID), channel, id, dev_handle, device_info, init_complete — 32-byte OOB write with firmware-controlled fields. _mapping_update_ir_missing_cnt :612-627 then also marks dpm_flush_entry[dpm_idx] (bounded) — fine.
5. mps_mapping_check_devices :1645-1664 — for (i = start_idx; i < end_idx + 1; ...) writes init_complete/missing_count at the OOB index; currently dead code (declared mpsvar.h:745, zero callers — the same deadness that neutralizes the DF-3915 twin in mps), noted for completeness.
6. _mapping_check_update_ir_mt_idx :2124-2129 — do { mt_idx++; if (mt_idx > end_idx) return 1; mt_entry = &sc->mapping_table[mt_idx]; } while (...) reads device_info at the OOB index.

Verification performed

• Guest pciconf -l (env.txt): no SAS HBA ⇒ no in-kernel run possible (same hardware gate as DF-1374/DF-1375/DF-3914..3919).
• harness_df4086.c on the guest (unprivileged user, cc 8.3): verbatim range computation + <= walks + the :2222-2232 event write; guard entry [max_devices] (canary 0x4141...) is overwritten with the fw WWID 0x57119418BADB00B5 → 32-byte OOB write proven; output identical across two runs (run.log, run.2.log).
• fix.diff (clamp end_idx <= max_devices - 1) applied to the guest /usr/src together with DF-4085's bound and the rest of this batch's mps fixes; module rebuilt with -Werror, mps.ko linked (BUILD_EXIT=0, fix_build.log); /usr/src restored pristine afterwards; guest reset with clean-source snapshot.

Exploitability ceiling

Same threat model as the other mps mapping findings (malicious/buggy IOC firmware or emulated HBA via PCI passthrough): IR config-change event → 32-byte struct write just past mapping_table with fw-chosen WWID/handle → adjacent slab-object corruption → potential kernel code execution. Gated here only by absent hardware.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.