DF-4093 — mpr _mapping_get_ir_maprange off-by-one: end_idx == max_devices → OOB reads + two 32-byte OOB write sinks (mpr twin of DF-4086)

File: sys/dev/raid/mpr/mpr_mapping.c (:241-255 range; <= walks :387, :430, :484, :2261, :2708; event write :3082-3088; kmalloc :2140-2141; facts :2564-2565)

Build

cc -O2 -Wall -o harness_df4093 harness_df4093.c

(DragonFly base cc 8.3; any unprivileged user; runs entirely in userland)

Run

./harness_df4093

Expected output (decisive lines)

  sizeof(dev_mapping_table) : 32 (expect 32 on amd64)
  facts: MaxTargets=0 MaxVolumes=255 -> max_devices=255 (:2565)
  valid mapping_table indices: 0..254 (kmalloc 8160 bytes :2140)
  IR maprange: start=1 end=255  (end == max_devices => OFF-BY-ONE: `<=` walks hit index 255)
  wwid walk :387 read physical_id at mapping_table[255] -> OOB READ
  free-idx walk :484 returned 255 (== max_devices, OUT OF BOUNDS)
  event write: mapping_table[255] = {wwid 0x57119418badb00b5, handle 0x0b1d, info 0x30000000}
  guard[255].physical_id == fw WWID: 32-byte heap OOB WRITE at index max_devices
  DPM volume branch :2261 accepted DeviceIndex 255 == end_idx -> second 32-byte OOB WRITE
RESULT: OFF-BY-ONE OOB READS + TWO 32-BYTE OOB WRITES PROVEN

Exit code 0 = primitive proven. run.log / run.2.log hold two identical guest runs.

What this proves

Object-level proof of the off-by-one and both write sinks: with firmware facts MaxTargets==0 + pg8 RESERVED_TARGETID_0 + low volume mapping, end_idx = start_idx + max_volumes - 1 == max_devices; every inclusive IR walk then touches mapping_table[max_devices] (OOB read), _mapping_get_free_ir_mt_idx can return the OOB index, and (a) mpr_mapping_ir_config_change_event writes a full firmware-controlled entry there on a volume-add event, and (b) the DPM-pg0 volume branch writes one there for a DeviceIndex == end_idx persistent entry.

Kernel-level status

Not reproducible on the audit guest: no SAS HBA on the PCI bus (env.txt), so mpr_attach never runs. Same hardware gate as DF-4086 (mps) and DF-3914/DF-3915 (mpr). Threat actor: malicious/buggy IOC firmware or a PCI-passthrough/emulated HBA.

DF-4093 VERDICT

Status: not_reproduced (kernel level) — hardware-gated; primitive proven at object level on the audit guest (userland harness, verbatim range function, walks and both write sinks). Confidence: certain.

mpr twin of DF-4086 (mps). Filed separately because the mps pass-2 audit deliberately did not double-file sibling findings.

Source chain (line-by-line)

1. mpr_mapping.c:2564-2565 max_volumes = facts->MaxVolumes (u8), max_devices = facts->MaxTargets + facts->MaxVolumes.
2. mpr_mapping.c:2140-2141 mapping_table = kmalloc(32 * max_devices) (sizeof verified 32 on amd64, mprvar.h:113-125).
3. mpr_mapping.c:241-255 _mapping_get_ir_maprange: with IRVolumeMappingFlags == LOW_VOLUME_MAPPING (:246-248) start_idx = 0, bumped to 1 when MPI2_IOCPAGE8_FLAGS_RESERVED_TARGETID_0 (:250-251); *end_idx = *start_idx + sc->max_volumes - 1 (:254) — unclamped. With firmware facts MaxTargets == 0 (⇒ max_devices == max_volumes), RESERVED_TARGETID_0 and low volume mapping — all three firmware- controlled — start_idx = 1 and end_idx = max_volumes = max_devices: one entry PAST the last valid index.
4. Every IR consumer walks map_idx <= end_idx and therefore touches mapping_table[max_devices]: - _mapping_get_ir_mt_idx_from_wwid :387 OOB read (physical_id) - _mapping_get_ir_mt_idx_from_handle :430 OOB read (dev_handle) - _mapping_get_free_ir_mt_idx :484 OOB read (device_info/ missing_count) and :486 returns the OOB index when the adjacent memory lacks MPR_MAP_IN_USE - _mapping_process_dpm_pg0 volume branch :2260-2271 accepts dev_idx == end_idx (DPM pg0 DeviceIndex, u16, fw-controlled) and writes a full entry at mapping_table[dev_idx] — unconditional 32-byte OOB write with fw PhysicalIdentifier - mpr_mapping_get_raid_tid :2708 OOB read (CAM-facing volume lookup)
5. Write sink A (event): mpr_mapping_ir_config_change_event :3045-3088 — on MPI2_EVENT_IR_CHANGE_RC_ADDED/VOLUME_CREATED for a volume whose WWID is not yet mapped, map_idx = _mapping_get_free_ir_mt_idx(sc) (:3071) returns max_devices when the in-range slots are busy; :3082-3088 writes physical_id = wwid_table[i] (fw volume WWID), id, dev_handle, device_info — full 32-byte fw-controlled entry one past the allocation. Write sink B (boot): the :2260-2271 DPM volume-branch write above — same index, reached at attach time from persistent mapping entries.

Note: _mapping_get_high_missing_mt_idx (:341-370) computes &mapping_table[end_idx_ir + 1] == &mapping_table[max_devices + 1] in the same configuration (:358) but its < loop then never dereferences it — benign pointer arithmetic, noted for completeness.

Distinct from the existing mpr findings

None of DF-3914..DF-3919 touches _mapping_get_ir_maprange or the IR walks; DF-3919 covers event element-count walks (frame-length mismatch), not the IR index range.

Verification performed

• Guest pciconf -l (env.txt): no SAS HBA ⇒ mpr_attach never runs; kernel-level reproduction impossible (same gate as DF-3914/DF-3915/ DF-4086).
• harness_df4093.c built and run twice as the unprivileged user on the guest (cc 8.3, zero warnings): verbatim range function (:241-255 low+reserved configuration), verbatim <= walks, verbatim event write (:3082-3088) and verbatim DPM volume branch (:2260-2271). Facts MaxTargets=0, MaxVolumes=255 ⇒ max_devices=255, start=1, end=255 == max_devices. Decisive results (run.log, stable):
• wwid walk reads physical_id at mapping_table[255] — OOB read;
• free-idx walk returns 255 (== max_devices) — the OOB index escapes;
• event write lands the fw WWID 0x57119418BADB00B5 at guard[255] — 32-byte heap OOB write, verified programmatically;
• DPM volume branch accepts DeviceIndex 255 == end_idx — a second, unconditional 32-byte OOB write.
• In-kernel equivalent: one 32-byte struct write just past an 8,160-byte kmalloc, contents firmware-chosen (volume WWID at offset 0, dev_handle, device_info). On the no-hardening audit guest this is classic adjacent- slab-object corruption once an HBA is present.

Fix validation

• fix.diff (this pack): clamp *end_idx to sc->max_devices - 1 at the end of _mapping_get_ir_maprange — same shape as the validated DF-4086 fix; fixes every <= consumer at once (:387, :430, :484, :2261, :2708).
• Applied together with DF-4092's bound-skip to the guest /usr/src; make in sys/dev/raid/mpr compiled all sources with -Werror and linked mpr.ko (BUILD_EXIT=0) — fix_build.log.
• Runtime fix validation not testable (no mpr HBA on the guest).
• /usr/src restored pristine after the build (md5 match, reverse-patch verified, no leftover artifacts).

Bottom line

Source-certain CWE-125/ CWE-787 off-by-one → OOB reads + two distinct 32-byte OOB write sinks, primitive proven at object level on the audit guest; kernel-level reproduction hardware-gated. Fix compiles clean with -Werror; recommended for upstream together with the mps twin DF-4086.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.