DF-4590 — tws(4) detach/unload never cancels driver callouts → use-after-free

Finding file: sys/dev/raid/tws/tws.c (pass 2) Lines: 346-410 (tws_detach), 273-276 (callout_init), 398-406 (frees); consumers tws_cam.c:847/893 (req->thandle), 1217/1232 (reset_cb), 1238/1256 (reinit).

What the bug is

tws_attach initializes three softc callouts (tws.c:274-276). During error recovery the driver schedules them:

• sc->reset_cb_handle — tws_reset() arms a hz/10 poll (tws_cam.c:1217); tws_reset_cb re-arms itself (1232) until the soft reset completes.
• sc->reinit_handle — tws_reset_cb arms a 5 s reinit poll (1238); tws_reinit re-arms itself every 5 s while the controller is not ready (1256) — with a wedged controller this cycles indefinitely (and can even re-assert soft resets).
• req->thandle — 60 s AEN-fetch / get-set-param timeouts (847, 893).

tws_detach() (tws.c:346-410) tears down the interrupt (370-374), then kfree()s sc->reqs (398), sc->sense_bufs (399), the AEN/trace queues (401-402), lockuninit()s the locks (403-406) and destroys the cdev (407) — without a single callout_stop/callout_cancel. A callout that is armed at detach time fires after those frees: tws_reinit/tws_reset_cb/tws_timeout dereference sc (and sc->reqs[i]) from freed heap → use-after-free in softirq context (panic at best, slab corruption at worst). The attach-failure unwinds (309-341) have the same hole.

Preconditions / reachability

• tws is built into X86_64_GENERIC (sys/config/X86_64_GENERIC:125), so the classic trigger is a module configuration (sys/dev/raid/tws/Makefile builds KMOD tws) and root kldunload tws.ko while a reset/reinit poll or a 60 s request timeout is pending — i.e. exactly when an operator unloads the driver to recover a wedged 9700-series card (the scenario DF-1924/DF-1925 describe). Requires a LSI 3ware 13C1:1010 controller.
• Privilege: root (kldunload). Hence severity Low, but the defect class is a kernel UAF (memcorrupt).

Reproduce (hardware required)

See trigger.sh for the exact recipe. EXPECTED vulnerable behavior: kldunload followed within ≤ 5 s by a kernel panic (page fault in softclock/tws_reinit) or heap corruption. Patched: clean unload.

On the audit guest: no 3ware controller exists (pciconf shows no 0x13C1 device; dev.tws absent; tws compiled into the kernel and attached to nothing — run.log / env.txt), so the trigger cannot run: verdict not_reproduced, defect certain from source.

Build / run on guest

./run.sh        # probes guest hardware; records absence in run.log

Fix

fix.diff: callout_cancel() the three softc callouts + all per-request thandles in tws_detach after IRQ teardown (before the kfrees), and callout_init() every req->thandle in tws_init_reqs so cancelling a never-used request is safe.

DF-4590 VERDICT — not_reproduced (hardware-gated), defect certain from source

Finding

tws_detach() (sys/dev/raid/tws/tws.c:346-410) frees the softc's dynamic state — kfree(sc->reqs) at :398, kfree(sc->sense_bufs) :399, xpt_free_ccb :400, kfree(sc->aen_q.q) :401, kfree(sc->trace_q.q) :402, lockuninit() :403-406 — while driver callouts that reference exactly that memory remain armed. Nothing between :346 and :410 calls callout_stop/callout_cancel on:

• sc->reset_cb_handle — armed at tws_cam.c:1217, re-armed at :1232,
• sc->reinit_handle — armed at tws_cam.c:1238, self-re-arming every 5 s at :1256 while !tws_ctlr_ready(sc) (i.e. forever on a wedged controller),
• sc->reqs[i].thandle — 60 s timeouts armed at tws_cam.c:847, :893 (callout_init happens in tws_get_request, tws.c:805).

The attach-failure unwinds (tws.c:309-341) have the identical hole.

A pending callout executing after detach fires tws_reinit() / tws_reset_cb() / tws_timeout() on freed heap and freed lock objects → use-after-free in softirq context (page-fault panic or silent slab corruption). With a module build (sys/dev/raid/tws/Makefile, KMOD=tws) the module text itself is also freed, so the callout target may be unmapped.

Why it is real and when it fires

The realistic operator sequence is: controller wedges (tws_reset runs, "Resetting controller" on console, reinit poll cycles every 5 s — the recovery path DF-1924/DF-1925 already documented as hang-prone) → operator unloads the driver to re-probe → kldunload tws → detach frees everything → ≤5 s later the reinit poll fires into freed memory. Root-privileged, hardware-dependent — hence severity Low — but the defect class is a kernel UAF (memcorrupt bucket).

Reproduction attempt on the audit guest

• Guest: DragonFly 6.5-DEVELOPMENT X86_64_GENERIC (env.txt).
• run.sh / run.log / guest_probe.log: no LSI 3ware (0x13C1) PCI device; dev.tws absent; tws compiled into the kernel and attached to nothing. QEMU has no 3ware 9700 emulation, so the trigger cannot execute: status not_reproduced, reproduced=0, impact none (not manifested here). Realistic impact ceiling on real hardware: UAF panic / heap corruption at driver unload (privileged trigger).

Confidence: certain — the missing cancellation is directly visible in the teardown function; every callout consumer pointer is softc/reqs memory that the same function frees first.

Fix validation

fix.diff: (1) callout_cancel() all three softc callouts and every reqs[i].thandle in tws_detach after bus_setup_intr teardown / pci_release_msi and before tws_cam_detach/frees; (2) callout_init(&sc->reqs[i].thandle) in tws_init_reqs so cancelling never-handed-out requests is safe. git apply --check passes. Baseline vs patched cannot be exercised on this guest (no 3ware HW) → fix_status: not_testable; validated by inspection against tws.c:346-410, 597-636 and tws_cam.c:1217-1256.

Artifacts

• trigger.sh — exact unload-during-recovery recipe
• run.sh, run.log, guest_probe.log, env.txt — guest hardware-absence proof
• fix.diff — callout cancellation (git-apply clean)
• manifest.json / verdict.json

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.