DF-4364 — mps_config.c polled-timeout: command freed while the IOC owns it

sys/dev/raid/mps/mps_config.c — every getter frees its struct mps_command on the error path even when mps_request_polled() returned ETIMEDOUT, i.e. when the request is still posted to the IOC:

• mps.c:2140-2161 mps_request_polled() breaks out after ~50 s with ETIMEDOUT — without cancelling the request or resetting the chip.
• every getter's out: label (mps_config.c:167, 311, 637, 762, 884, 1001, 1120, 1241, 1386) runs mps_free_command(sc, cm) (mpsvar.h:514-540), which zeroes the command and returns it to sc->req_list — while the IOC still owns that SMID.
• when the wedged IOC later completes the request, mps_intr_locked() (mps.c:1581-1600) does cm = &sc->commands[SMID], writes cm->cm_reply/cm->cm_reply_data onto the freed or reallocated object, and calls mps_complete_command(cm) → the new owner's completion callback runs with the stale CONFIG reply; later frees return a foreign reply slot to the reply free queue (or leak it → reply-queue exhaustion).

The successor driver fixed exactly this: mpr_wait_command() (sys/dev/raid/mpr/mpr.c:3557-3622) takes struct mpr_command **cmp, on timeout performs mpr_reinit() (diag reset → the stale request can never complete) and clears *cmp when the reinit freed the command.

Reproduce (DragonFly guest, unprivileged)

cc -O2 -Wall -o harness harness.c && ./harness     # exit 1: violations CONFIRMED
cc -O2 -Wall -DFIXED -o harness_fixed harness.c && ./harness_fixed   # exit 0

The guest has no LSI mps HBA, so — per the DF-1556/DF-1557 precedent — the harness mirrors the kernel object lifecycle field-for-field (free-list semantics of mpsvar.h:514-555, the polled timeout, the late address-reply completion of mps.c:1581-1600) and asserts the kernel invariants. Baseline: 2/2 scenarios violate them; fixed model (mps_request_polled → mps_reinit on timeout, mirroring mpr): 0/2.

Files

• harness.c — lifecycle state-machine harness (baseline + -DFIXED)
• build.sh / run.sh — exact commands
• run.log — FULL guest output: build + decisive baseline (RUN_EXIT=1) + fixed validation (FIXED_EXIT=0)
• env.txt — guest uname / compiler / mps-in-GENERIC / no-HBA proof
• fix.diff — git-apply-able fix vs sys/dev/raid/mps/mps.c
• VERDICT.md, manifest.json, verdict.json

DF-4364 VERDICT

Status: reproduced (harness; guest has no mps HBA — DF-1556/1557 method). Impact class: use-after-free / cross-request completion confusion / reply-queue corruption (CWE-416/662). Primitive certain at the lifecycle level.

Root cause (line-accurate)

1. mps_request_polled() — sys/dev/raid/mps/mps.c:2140-2161: polls for ~50 s (timeout++ > 1000 × 50 ms), then returns ETIMEDOUT with the request frame still posted to the IOC. No reinit, no cancel. (Contrast mpr_wait_command, sys/dev/raid/mpr/mpr.c:3557-3622: timeout → mpr_reinit(sc) diag reset + *cmp = NULL when the reinit freed the command — the upstream fix for precisely this hazard.)
2. All ten getters in sys/dev/raid/mps/mps_config.c treat any error from mps_request_polled as "command complete": goto out → mps_free_command(sc, cm) at the out: labels (mps_config.c:167-168, 311-312, 637-638, 761-762, 884-885, 1001-1002, 1120-1121, 1241-1242, 1386-1387).
3. mps_free_command() — mpsvar.h:514-540 — zeroes the command (cm_reply, cm_flags, cm_complete, …) and pushes it onto sc->req_list; the SMID the IOC owns is untouched and the request stays outstanding.
4. Late completion, mps_intr_locked() — mps.c:1518-1600: cm = &sc->commands[desc->AddressReply.SMID] (:1581) → the freed or since-reallocated command; cm->cm_reply = reply and cm->cm_reply_data = … (:1582-1584) are writes into a foreign object; mps_complete_command(cm) (:1600, body :1405-1431) then runs the new owner's cm_complete callback with the stale CONFIG reply, wakes the wrong sleeper, and decrements io_cmds_active.
5. Follow-on corruption when the confused owner later completes: * reallocated-as-SCSI-IO case — the SCSI completion misparses the CONFIG reply; mps_free_command returns the stale reply frame address to the reply free queue (mpsvar.h:518-519) — a foreign/double slot free (reply FIFO accounting corrupted); * still-FREE case — the FREE object now carries live cm_reply fields; the next mps_alloc_command() hands it out; if that request completes via the SCSI_IO_SUCCESS path (cm_reply = NULL, mps.c:1516) the slot is leaked → progressive reply-queue exhaustion → adapter wedge (DoS).

Preconditions: an IOC that stalls a config request for ~50 s and completes it afterwards — a hung, buggy, or malicious firmware (or device posing as the HBA). Not unprivileged-user-reachable without such hardware; same device-trust threat model as the known DF-1556/DF-1557, which is why this is Medium rather than High.

Reproduction (guest, unprivileged user maxx)

harness.c mirrors the kernel lifecycle field-for-field (free-list order and field zeroing of mpsvar.h:514-555; polled timeout of mps.c:2150-2158; late address-reply completion of mps.c:1581-1600; mps_complete_command of mps.c:1405-1431; reply-slot ownership epochs standing in for reply-free-queue frames). Two scenarios:

• A (reallocated): timed-out config cm freed → immediately reused for a SCSI IO (BUSY, callback installed, canary) → late completion lands on the BUSY command: CROSS-REQUEST COMPLETION (SCSI callback invoked with the CONFIG reply frame), FOREIGN FIELDS written onto the live command, REPLY FOREIGN-FREE when the SCSI IO later frees it. CONFIRMED.
• B (still free): late completion writes cm_reply/cm_reply_data onto the FREE object → reply slot DOUBLE-BOOKED (leak or double-free on the next owner). CONFIRMED.

Baseline RUN_EXIT=1 (2/2 scenarios violated). Full output in run.log.

Fix validation

fix.diff (against the read-only sys/ tree; never applied there) mirrors the proven mpr pattern: on timeout, mps_request_polled() calls mps_reinit(sc) (diag reset — the IOC discards outstanding requests, so a late completion is impossible) before returning ETIMEDOUT, making the callers' frees safe. Modeled with -DFIXED: both scenarios hold all invariants, FIXED_EXIT=0. (An alternative minimal backport — leak the command on ETIMEDOUT in the config getters instead of freeing — has the same safety property; the reinit variant additionally recovers the adapter and matches upstream evolution.) fix_status: fixed at harness level; a kernel-build validation is impossible on this guest (no HBA).

Guest left clean (userland harness only, /tmp artifacts).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.