DF-4640 — ips attach-time info commands: timeout unwind frees the static command slot and its DMA resources while the adapter still owns the command

File: sys/dev/raid/ips/ips_commands.c:313-332 (adapter info, 30 s budget), :411-433 (drive info, 10 s) Severity: Low (trigger = adapter that exceeds the timeout, i.e. failing/flaky hardware) · Confidence: certain (code path unconditional once the timeout fires) Class: CWE-416 (use-after-free of DMA backing) + NULL/wrong indirect callback on late completion

No runnable PoC exists for this class on the audit guest: the path requires a real IBM ServeRAID PCI adapter that is slow (not dead) — QEMU has no device model, the guest has zero 0x1014/0x9005 devices and no /dev/ips* (env.txt). The evidence is the line-accurate static trace below; timeout_uaf_path.c encodes it as an annotated path listing.

Trace

1. ips_adapter_init → ips_get_adapter_info (ips.c:426, ips.c:336) → ips_send_adapter_info_cmd (ips_commands.c:288) with the STATIC command slot 0 (IPS_STATIC_FLAG, ips.c:211-217).
2. The info buffer is allocated (bus_dmamem_alloc, :307), the load callback issues the command to the adapter (sc->ips_issue_cmd, :284 via ips_adapter_info_callback).
3. ips_timed_wait(command, "ips", 30*hz) (:317) — the ONLY completion signal is the adapter's interrupt (ips_wakeup_callback, :66-72). If the adapter is wedged-but-alive, tsleep returns ETIMEDOUT.
4. The unwind then does, unconditionally: - bus_dmamap_unload (:325) — unload while the device may still DMA, - bus_dmamem_free(data_dmatag, data_buffer, ...) (:328) — the DMA target buffer is returned to the kernel heap while the adapter still holds the command, - bus_dma_tag_destroy(data_dmatag) (:330), - ips_insert_free_cmd (:331) — clears IPS_STATIC_BUSY so slot 0 can be handed out again (ips_get_free_cmd, ips.c:211-217) — during attach, the very next consumer is ips_update_nvram (ips.c:432) or ips_get_drive_info (ips.c:437).
5. When the adapter eventually completes the stale command: - hardware DMA-writes IPS_ADAPTER_INFO_LEN bytes into the freed buffer (device-side UAF write into kernel heap), and - ips_morpheus_check_intr (ips.c:567-576) / ips_copperhead_intr execute commandarray[0]->callback(command): if slot 0 was re-gotten, ips_get_free_cmd has zeroed callback (ips.c:232 bzero region includes callback) → NULL indirect call, kernel panic; if the new owner already installed its callback, the NEW command is falsely completed (ips_timed_wait returns while its data buffer is still in flight → memcpy(&sc->adapter_info, ...) :322 of stale data / nvram write of a half-DMA'd page :603-608).

Distinction from the filed ips family

• DF-4614 covers the queue teardown frees (ips_cmdqueue_free / ips_cmdqueue_init at ips.c) freeing under live commands on detach/error. DF-4640 is the per-command timeout unwind inside ips_commands.c handing back a slot and freeing DMA resources the hardware still owns — a different call site and a different trigger (no detach needed).
• DF-4613 covers the watchdog-path lock inversion; the sibling wait-family defect noted here is that every OTHER static command uses ips_timed_wait(..., 0) = infinite tsleep (ips_commands.c:471, :558, :673, :722, :743), so a card wedging mid-attach hangs the boot thread forever rather than timing out.

Fix sketch (see verdict.json recommended_fix)

On ETIMEDOUT, do NOT free/recycle: leave the command owned (keep IPS_STATIC_BUSY set, keep the DMA allocation) and let the watchdog (ips_timeout) — or attach failure path with the adapter quiesced — reclaim it; alternatively fail attach hard (ENXIO) without recycling slot 0 until the adapter is reset, and give the infinite waits finite budgets.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)