DF-4239
Stale ata_xfer resid propagated to CAM for zero-data commands: sili_unload_prb skips the resid update when datalen==0 and the completion copies the previous command's resid into csio->resid
Summary
sili_unload_prb only computes xa->resid when datalen != 0 and nothing clears it on recycle, but both CAM completion handlers copy it unconditionally. Any zero-length command (CAM_DIR_NONE passthrough, ATAPI TEST_UNIT_READY, FLUSH completion) reports the previous command's transfer accounting to CAM/userspace (e.g. resid=262144 against dxfer_len=0) - data-accounting integrity defect that can mask real short-transfer conditions. Zero-or-init fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4239 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 149 B | ↓ raw | |
| verdict.json | file | 1.1 KB | view raw |
README.md
file
↓ download raw
DF-4239 — sili stale resid propagation
Zero-data commands report the previous command's resid to CAM. Hardware-gated; PoC skipped per contract.
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
zero resid for no-data commands in both completions, or init ccb_xa.resid=0 in sili_get_ccb so recycling cannot leak stale accounting
source-only
per-fix-DF-4239
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
sili.c:1278-1290 resid gated on datalen!=0; sili_cam.c:1667/1714 unconditional copy
Verdict
source-verified; hardware-gated (no sili HBA on audit guest)
No comments yet.