DF-4173 — iir(4) iir_shutdown: flush ucmd freed while in flight (+ wrong malloc type, double-queue reuse)

Build / Run

There is no userland trigger: the flaw is in the shutdown_post_sync event handler (iir_shutdown, sys/dev/raid/iir/iir.c:1478-1520) and manifests when the controller is slow/hung at shutdown.

To document the hardware gate on the audit guest, run:

sh gate_check.sh          # no /dev/iir, no iir PCI device, iir never attached

Expected on hardware-less guest: no iir/isp PCI device present.

Expected on a machine with iir hardware and a controller that fails to complete a GDT_FLUSH within 10 s: the shared ucmd is (a) re-inserted into sc_ucmd_queue for the next host drive while the previous dispatch still owns it, and (b) unconditionally kfreed (with the wrong type M_DEVBUF) while a pending gccb still points at it → the next GDT_GCF_IOCTL completion (iir.c:1599-1633) writes ucmd->status, bcopys up to 3 KB into the freed ucmd->data, and calls wakeup(ucmd) → use-after-free write into freed kernel heap.

Fix

fix.diff allocates one ucmd per host drive, frees only completed ones, and frees with the correct type (M_GDTBUF).

DF-4173 VERDICT — iir_shutdown ucmd use-after-free / double-queue / wrong free type

Status: untested on this guest (hardware-gated: shutdown path of the iir driver, no controller present). Bug existence: certain from code trace.

Reproduced?

No runtime reproduction: the guest has no iir controller (gate_check.log), and the buggy path is the system-shutdown handler, driven by controller completion latency. The gate is proven; the code trace below is line-accurate.

Code trace

1. iir_shutdown (iir.c:1478-1520) allocates one gdt_ucmd_t with kmalloc(..., M_GDTBUF, ...) (iir.c:1493).
2. For each present host drive it fills that single ucmd, queues it (TAILQ_INSERT_TAIL(&gdt->sc_ucmd_queue, ucmd, links), iir.c:1509), dispatches via gdt_next(), and waits at most 10 s (tsleep(..., 10*hz), iir.c:1514).
3. gdt_next() removes the ucmd from the queue when dispatching it (iir.c:706) and the owning gccb keeps gccb->gc_ucmd = ucmd (iir.c:1006). Until the controller completes the command the ucmd is owned by that in-flight gccb.
4. Defect A (double-queue): if the 10 s sleep expires with complete_flag == FALSE, the next loop iteration overwrites the same ucmd's fields while the controller still owns it, and inserts it into sc_ucmd_queue again — one ucmd now referenced by an in-flight gccb and queued for a second gccb.
5. Defect B (UAF): after the loop, kfree(ucmd, M_DEVBUF) (iir.c:1518) frees the ucmd unconditionally — including while it is still in flight and/or still linked into sc_ucmd_queue. The later GDT_GCF_IOCTL completion path (iir.c:1599-1633) then does: - ucmd->status = gdt->sc_status; ucmd->info = …; ucmd->complete_flag = TRUE; (iir.c:1608-1610) — writes into freed memory; - bcopy(gccb->gc_scratch, ucmd->data, cnt) with cnt up to GDT_SCRATCH_SZ = 3072 (iir.c:1613-1626) — a 3 KB-class write into a freed ~3.1 KB heap chunk (heap corruption if reallocated); - TAILQ_INSERT_HEAD(&gdt->sc_ucmd_queue, ucmd, links) on the BSY path (iir.c:1604) — links freed memory into a live list; - wakeup(ucmd) (iir.c:1632).
6. Defect C (type mismatch): allocated with M_GDTBUF, freed with M_DEVBUF (iir.c:1493 vs 1518) — benign without MALLOC_DEBUG, but wrong.

Impact ceiling

Shutdown-time UAF write / list corruption, requiring an iir controller that stalls ≥10 s on a flush. Not software-triggerable. Severity Low; bucket: memcorrupt.

Fix validation

fix.diff (one ucmd per drive, free-only-when-complete, correct type) passes git apply --check. No kernel-build/runtime validation possible without hardware; fix_status = not_testable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.