DF-4639 — ips(4): debug.ips.ignore_flush_cmd polarity inverted — adapter cache-flush silently dropped on DEFAULT configuration

File: sys/dev/raid/ips/ips_commands.c:195-220 (supporting: :35-40, :249-252) Severity: Medium (data integrity on default config) · Confidence: certain Class: CWE-670 (Always-Incorrect Control Flow Implementation)

Build

sh build.sh          # cc -O2 -Wall -o /tmp/flush_invert_harness flush_invert_harness.c

Run

sh run.sh            # uname, live sysctl default, harness as unprivileged user

Expected output (bug present)

debug.ips.ignore_flush_cmd: 0
DEFAULT (flag=0):   flag=0 -> adapter_cmds_issued=0 last_opcode=0x00 bio_finished=1(no error)
DEBUG SET (flag=1): flag=1 -> adapter_cmds_issued=1 last_opcode=0x0a bio_finished=0(no error)
RESULT: INVERTED — with the DEFAULT value the real adapter cache-flush ...
harness exit code: 42

What it proves

1. Live guest kernel (ips driver compiled into X86_64_GENERIC): the sysctl exists and its default is 0 (run.log line 2; source ips_commands.c:35-36 TUNABLE_INT(..., &ips_debug_ignore_flush_cmd) — static, i.e. zero-initialized).
2. The branch (ips_commands.c:202): if (!ips_debug_ignore_flush_cmd) is taken at the DEFAULT — it frees the command slot, completes the bio with no error, and returns without ever building/issuing IPS_CACHE_FLUSH_CMD to the adapter. Setting the debug flag to 1 — which per the sysctl's own description ("Do not issue IPS_CACHE_FLUSH_CMD on BUF_CMD_FLUSH", ips_commands.c:40) should SUPPRESS the command — instead issues it.

Impact

Every BUF_CMD_FLUSH bio on an ips disk (fsync(2)/close-time flush on the raw device, filesystem metadata flushes, unmount flush) is reported complete while the ServeRAID adapter's volatile write cache is never told to flush. After fsync() returns, the just-synced data can still be lost on power failure — the durability contract of fsync is silently violated on a stock kernel. (The separate shutdown-path flush ips_flush_cache(), ips_commands.c:476-493, does issue the real command, so the damage window is "flush returned → next real flush/shutdown".)

Fix

fix.diff — invert the condition so the debug knob does what it documents (skip the command only when SET). verdict.json records fix_status: not_testable: an end-to-end A/B (observing opcode 0x0A on the wire) requires ServeRAID hardware, which the audit guest cannot instantiate (QEMU has no such device model; env.txt).

DF-4639 VERDICT — reproduced (logic inversion on live default; hardware end-to-end not observable on guest)

The claim

ips_send_flush_request (sys/dev/raid/ips/ips_commands.c:195-220) contains a debug tunable whose polarity is inverted, so the default configuration drops every BUF_CMD_FLUSH instead of forwarding it to the adapter as a IPS_CACHE_FLUSH_CMD.

Proof chain

1. Default value is 0. - Source: ips_commands.c:35-36 — static int ips_debug_ignore_flush_cmd;

   • TUNABLE_INT("debug.ips.ignore_flush_cmd", ...) (BSS ⇒ 0).
   • Live guest: sysctl debug.ips.ignore_flush_cmd → 0 (run.log; the ips driver is compiled into the guest's X86_64_GENERIC kernel).

2. Dispatch reaches the function for every flush bio. ipsd_strategy (ips_disk.c:128-140) queues the bio and calls ips_start_io_request (ips_commands.c:237-253), which at :249 branches b_cmd == BUF_CMD_FLUSH → ips_send_flush_request (:250).

3. The branch skips the adapter command at flag==0. ips_commands.c:202-206: c if (!ips_debug_ignore_flush_cmd) { ips_insert_free_cmd(sc, command); ipsd_finish(bio); /* completed, NO B_ERROR set */ return 0; } The real command build (flush_cmd->command = IPS_CACHE_FLUSH_CMD; :210) and issue (sc->ips_issue_cmd(command) :218) are only reachable when the flag is SET (1).

4. Documented semantics are the opposite. ips_commands.c:38-40: SYSCTL description "Do not issue IPS_CACHE_FLUSH_CMD on BUF_CMD_FLUSH" — i.e. flag SET ⇒ skip. FreeBSD upstream has no such tunable (the whole flush-request block is DragonFly-added; verified against freebsd-src ips_commands.c HEAD — no ignore_flush_cmd/ips_send_flush_request there), so this is DF-introduced, not inherited.

5. Harness run (guest, unprivileged user maxx): the exact branch extracted verbatim into flush_invert_harness.c — flag=0 → adapter_cmds_issued=0, bio_finished=1 (no error); flag=1 → adapter_cmds_issued=1, last_opcode=0x0A (IPS_CACHE_FLUSH_CMD). Exit marker 42. See run.log.

What was and was not reproduced

• REPRODUCED: the inverted control flow itself, at the live kernel's default flag value, from an unprivileged account (the harness is exact-logic; the sysctl default is read from the running kernel).
• NOT observable on this guest: the on-the-wire adapter command. The guest has zero ServeRAID PCI devices and QEMU has no ips device model (env.txt: 0 matches for vendor 0x1014/0x9005; /dev/ips* absent), so the path cannot be instantiated with hardware. The consequence — fsync() data lying in the adapter cache — follows mechanically from the proven branch.

Fix validation

fix.diff flips the condition to if (ips_debug_ignore_flush_cmd) so the skip path only runs when the operator explicitly asks for it. An A/B kernel run cannot change the observable (the branch is proven by harness either way; the end-to-end effect needs hardware), so fix_status: not_testable, fix_baseline_reproduced: 1, fix_patched_reproduced: 0.

Related

• DF-4613..4616 (ips.c watchdog/queue/reinit/dump) — adjacent ips family, all distinct root causes.
• No other consumer of ips_debug_ignore_flush_cmd exists (rg ignore_flush sys/ → ips_commands.c only).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.