DF-4837 — ida bio path leaves qcb->flags == 0: bounced READ data never copied back + bounce pages leak

• File: sys/dev/raid/ida/ida.c:391 (with :399-401 and :506-513)
• Severity: Medium (silent disk-data corruption + per-I/O bounce-page leak on

  4 GB machines with this 32-bit PCI card; benign on ≤4 GB boxes)

• Reproduced: logic/bounce-accounting harness on the DragonFly guest (no Compaq SMART controller exists in the guest).

Root cause

ida_construct_qcb() clears qcb->flags = 0 (ida.c:391) and never sets the DMA direction for disk I/O, so:

• ida.c:399-401 computes the pre-sync as BUS_DMASYNC_PREWRITE for every bio (reads included);
• ida_done() gates the post-completion work on qcb->flags & DMA_DATA_TRANSFER (ida.c:506) — which is 0 for every bio — so BUS_DMASYNC_POSTREAD never runs and bus_dmamap_unload() is never called for disk I/O.

On machines with >4 GB RAM this is not cosmetic: the buffer tag inherits the parent's 32-bit limit (ida_pci.c:260-265; DFly clamps child lowaddr, busdma_machdep.c:272 MIN(parent->lowaddr, ...)), so buffer pages above 4 GB bounce. DFly busdma then requires

• bus_dmamap_sync(PREWRITE) orig→bounce (busdma_machdep.c:1044-1053) — done,
• bus_dmamap_sync(POSTREAD) bounce→orig (busdma_machdep.c:1054-1063) — skipped: the device's read data stays in the bounce page and the caller's buffer keeps stale contents (silent data corruption on every bounced READ),
• bus_dmamap_unload to return bounce pages to the zone free list (map->bpages, add_bounce_page/return_bounce_pages) — skipped: each load appends bounce pages that are never returned → unbounded kernel memory leak that grows with every disk I/O.

Build / run (on the DragonFly guest)

cc -O2 -Wall -o df4837 df4837_harness.c
./df4837

Expected

• BASELINE single READ: caller buffer STALE (device data LOST), leaked=1.
• BASELINE 64 READs: leaked=64 (one bounce page per I/O, none returned).
• FIXED (flags set per direction, per fix.diff): buffer has device data, leaked=0 for both arms (page returned by the unload).

See run.log, VERDICT.md, fix.diff.

DF-4837 — VERDICT

REPRODUCED (logic/bounce-accounting harness; guest has no Compaq SMART/IDA controller — DF-4559 methodology).

The code path (traced)

1. ida_construct_qcb() — sys/dev/raid/ida/ida.c:373-417: - :391 qcb->flags = 0; — never given DMA_DATA_IN/DMA_DATA_OUT for the bio path (contrast ida_command() :350, which sets flags | IDA_COMMAND for internal commands). - :396-401 loads the buffer and syncs with op = qcb->flags & DMA_DATA_IN ? BUS_DMASYNC_PREREAD : BUS_DMASYNC_PREWRITE — always PREWRITE, including for BUF_CMD_READ bios.
2. ida_done() — ida.c:499-538: - :506 if (qcb->flags & DMA_DATA_TRANSFER) — 0 for every bio → the whole block is skipped:
   • :509-511 POSTREAD sync never executes,
   • :512 bus_dmamap_unload() never called.
3. Why it matters only above 4 GB: the buffer tag is created with lowaddr = BUS_SPACE_MAXADDR (ida.c:209-213) but DFly clamps the child to the parent's BUS_SPACE_MAXADDR_32BIT (ida_pci.c:260-265; busdma_machdep.c:272 newtag->lowaddr = MIN(parent->lowaddr, newtag->lowaddr)), so on >4 GB machines pages above 4 GB bounce (addr_needs_bounce, busdma_machdep.c:180-189).
4. Bounce data path (busdma_machdep.c:1034-1067): the device DMAs into the bounce page; only bus_dmamap_sync(BUS_DMASYNC_POSTREAD) copies bounce→orig (:1054-1063). Skipped ⇒ every bounced READ completes "successfully" with the buffer's previous contents — silent disk data corruption for the FS layer. add_bounce_page appends to map->bpages; only unload/return_bounce_pages gives them back — skipped ⇒ one leaked bounce page per I/O, unbounded.

On ≤4 GB machines the tag never bounces (lowaddr ≥ ptoa(Maxmem) ⇒ no BUS_DMA_BOUNCE_LOWADDR), sync/unload are bookkeeping-only and the bug is latent — which is why this ancient driver "works" on small boxes.

What the harness proves (run.log)

Faithful model of the map/zone bookkeeping (map_load reserves a bounce page per load; PREWRITE copies orig→bounce; POSTREAD copies bounce→orig; unload returns pages) driven by the verbatim flag logic of ida.c:

• BASELINE, 1 READ: buffer stays STALE (device data lost), 1 bounce page held.
• BASELINE, 64 READs: still stale, 64 bounce pages held (none returned).
• FIXED (per-direction flags per fix.diff): buffer receives the device data, 0 pages held after either arm (page returned by unload).

Impact

• Integrity: silently wrong data returned for filesystem reads whose pages live above 4 GB (no error surfaced — bio completes B_OK).
• Availability: unbounded kernel-memory leak growing with every bounced I/O; eventual memory pressure / stall.
• Precondition: >4 GB RAM + a Compaq SMART/IDA (32-bit PCI) controller — old card in a big box (data-recovery setups are exactly this). No attacker control needed beyond ordinary disk I/O once the config exists.

Fix

Set the DMA direction flags on the bio path (and, in ida_command(), assign qcb->flags before the pre-sync instead of after) — fix.diff.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.