DF-4834 — mrsas_passthru() raw userland pointer: validation→use TOCTOU walks past 16-entry stack arrays

• File: sys/dev/raid/mrsas/mrsas_ioctl.c (entry: sys/dev/raid/mrsas/mrsas.c:1151)
• Severity: High (kernel stack OOB write + OOB stack reads; root/operator-gated ioctl)
• Reproduced: harness on the DragonFly guest (no mrsas controller exists in the guest — same methodology as DF-4559/DF-4363).

Root cause

mrsas_ioctl() (mrsas.c:1151) passes the raw userland a_data pointer into mrsas_passthru(). Every field access in the passthrough then reads/writes user memory directly, with no copyin:

• mrsas_ioctl.c:186 validates user_ioc->sge_count > MAX_IOCTL_SGE (16) — a read of USER memory
• mrsas_ioctl.c:225 for (i = 0; i < user_ioc->sge_count; i++) — re-reads USER memory, and the body writes &ioctl_data_tag[i], &ioctl_data_mem[i], &ioctl_data_phys_addr[i] — stack arrays declared [MAX_IOCTL_SGE] (=16) at mrsas_ioctl.c:153-156
• mrsas_ioctl.c:307 the copyout loop re-reads sge_count/sgl[] a second time, after the multi-millisecond firmware command (mrsas_issue_blocked_cmd, :301) — a very wide race window; it reads ioctl_data_mem[i] OOB from the stack and uses the value as the copyout source
• mrsas_ioctl.c:354 the cleanup loop re-reads a third time and calls bus_dmamap_unload(ioctl_data_tag[i], ...) with OOB-read garbage

A second thread of the ioctl caller (any process with the device open — /dev/mrsasN is root:operator 0660, mrsas.c:790-792) flips sge_count after validation → i runs toward 2^32-1 → OOB write of kernel heap pointers at &ioctl_data_tag[i] with a fully attacker-chosen offset (8·i bytes past the array — i.e., across ida-style adjacent locals, saved registers and the return address of mrsas_passthru), OOB stack reads used as copyout sources (kernel stack contents disclosed when the slot holds a valid kernel pointer, copyout only validates the destination), and wild bus_dmamap_unload calls in cleanup.

Additionally, because there is no copyin, an unmapped or read-only ioctl argument makes the kernel fault on the first raw deref (mrsas_ioctl.c:172) with no on-fault protection → kernel panic.

Build / run (on the DragonFly guest)

cc -O2 -Wall -o df4834 df4834_harness.c -lpthread
./df4834

Expected

• arm 1 (race at the validation→use boundary): SIGSEGV at the guard page standing in for the rest of the kernel stack frame; canary slots 16..~591 (kernel: return-address/saved-regs region) overwritten with heap pointers.
• arm 2 (deterministic wide window; flip during the FW command): copyout loop reads ioctl_data_mem[16..23] from past the array — kernel stack values used as copyout sources.
• arm 3 (FIXED model — kernel copy of the packet): all loops stay in [0,16), no writes past the arrays.

See run.log, VERDICT.md, fix.diff.

DF-4834 — VERDICT

REPRODUCED (harness; the guest has no LSI MegaRAID controller — same methodology as DF-4559/DF-4363).

The code path (traced)

1. mrsas_ioctl() — sys/dev/raid/mrsas/mrsas.c:1112-1159. arg = ap->a_data (line 1116) is the raw userland pointer of ioctl(2); line 1151 hands it to mrsas_passthru(sc, (void *)arg) with no copyin.
2. mrsas_passthru() — sys/dev/raid/mrsas/mrsas_ioctl.c:148-370. user_ioc therefore points into user address space for the whole call: - :172 in_cmd->dcmd.opcode — first raw user deref (unmapped arg ⇒ unprotected kernel page fault ⇒ panic; on SMAP-enabled CPUs every call faults). - :174 user_ioc->frame.hdr.cmd_status = MFI_STAT_OK — raw kernel write into user memory (RO mapping ⇒ panic). - :186 validation user_ioc->sge_count > MAX_IOCTL_SGE (16) reads user mem. - :153-156 stack arrays ioctl_data_tag[16] / ioctl_data_dmamap[16] / ioctl_data_mem[16] / ioctl_data_phys_addr[16]. - :225-264 the copyin loop re-reads user_ioc->sge_count every iteration and writes &ioctl_data_tag[i] (:237), &ioctl_data_mem[i] (:241-242), &ioctl_data_phys_addr[i] (:246-248), plus kern_sge32[i] (:254-255 — into the 1024-byte frame DMA block). - :301 mrsas_issue_blocked_cmd() — the firmware round-trip (up to 180 s wait budget, MRSAS_INTERNAL_CMD_WAIT_TIME=180) — a very wide window. - :307-314 copyout loop — second re-read of sge_count/sgl[]; reads ioctl_data_mem[i] OOB and uses the stack value as the copyout source (copyout validates only the destination, sys/platform/pc64/x86_64/support.s:228-258 — a valid kernel pointer as source becomes a kernel-memory disclosure). - :354-364 cleanup loop — third re-read; bus_dmamap_unload(ioctl_data_tag[i], ...) with OOB-read stack garbage.
3. The ioctl is reachable by root and the operator group (make_dev(..., UID_ROOT, GID_OPERATOR, 0660), mrsas.c:790-792).

What the harness proves (run.log)

• arm 1 — flip sge_count 16→0x20000 right after the check: the loop writes ioctl_data_tag[i]/ioctl_data_mem[i] out of bounds until it hits the guard page (SIGSEGV). Canary slots 16..591 recorded hits — in the kernel those slots are the rest of mrsas_passthru's frame (adjacent locals, saved registers, return address) and the write value is a heap pointer (bus_dma_tag). Attacker-chosen offset: 8·i bytes, i up to 2^32-1.
• arm 2 — deterministic mid-command flip: the copyout loop reads ioctl_data_mem[16..23] past the array and uses the (kernel stack) values as copyout sources — the leak/wild-deref class, no tight race required.
• arm 3 — kernel-copy model (the fix): racer is invisible, loops stay bounded, zero writes past the arrays.

Escalation ceiling (honest)

Primitive = controlled-offset kernel stack OOB write of kernel heap pointers + OOB stack reads (disclosure when a valid pointer sits in the slot) + wild bus_dmamap_unload on garbage. On this non-SMEP/no-KASLR target a full stack-pivot chain is plausible, but the ioctl requires root/operator and the guest has no mrsas device, so end-to-end uid=0 could not be demonstrated — same limitation recorded for the pass-1 family (DF-1917..DF-1919, PR:L per this audit's convention).

Fix

Copy the packet in at the ioctl entry and operate on the kernel copy (fix.diff, kernel-copy model validated by harness arm 3).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.