DF-4971 — mfip_detach leaks queued CAM ccbs and leaves a stale mfi_cam_start callback

sys/dev/raid/mfi/mfi_cam.c:142-159 — mfip_detach() deregisters the bus and frees the sim but (a) never drains sc->mfi_sc->mfi_cam_ccbq — ccbs the SIM accepted via mfip_cam_action XPT_SCSI_IO (mfi_cam.c:242) but the controller had no free command for — and (b) never clears sc->mfi_sc->mfi_cam_start (set at mfi_cam.c:116). xpt_bus_deregister cannot recover SIM-private ccbs (cam_xpt.c:4383 XXX), and mfip_cam_action has no XPT_ABORT support, so the leaked ccbs hang forever; the still-live parent controller's mfi_startio (invoked from mfi_intr at mfi.c:1245 and from mfi_shutdown, both running after child deletion in mfi_pci_detach mfi_pci.c:328-335) then pops them through the stale callback and completes them via xpt_done on a deregistered bus (path->bus->sim == &cam_dead_sim, cam_xpt.c:4456) with periphs already destroyed — a CAM-state UAF shape; on kldunload the callback target is unmapped module text.

Files

• mfip_detach_mirror.c — choreography mirror: DFly CAM refcount semantics transcribed from cam_sim.c/cam_xpt.c + verbatim mfip_attach/action/start detach structure; stock vs fixed detach
• build.sh, run.sh, build.log, run.log, run.2.log
• fix.diff — drain + clear-callback fix
• fix_build.log — patched mfip.ko builds on the guest with -Werror
• env.txt — guest environment (no LSI MegaRAID HBA)

Reproduce

sh build.sh && sh run.sh

Expected decisive lines (BUGGY mode):

post-detach: sim freed=1 bus sim=dead_sim queued-nonempty=YES mfi_cam_start=STALE (mfip_start)
V1 VIOLATED: 3 ccb(s) leaked in mfi_cam_ccbq ...
V2 VIOLATED: mfi_cam_start still set after sim freed
    [xpt_done] UAF: ccb 1 completed after its periph was destroyed (dispatch sim=0x... dead_sim)
    [mfip_start] UAF: call into unmapped module text after kldunload
BUGGY: 4 violation(s)   exit=1

FIXED mode: FIXED: 0 violation(s) exit=0.

Kernel-path reproduction is impossible on this guest (no LSI 0x1000 PCI device; QEMU has no MegaRAID model) — see VERDICT.md.

DF-4971 VERDICT — mfip_detach lifecycle bug: static trace complete + choreography mirror; kernel path not instantiable on guest

Bottom line

mfip_detach() (mfi_cam.c:142-159) frees the sim without (a) draining the SIM-private CAM queue mfisc->mfi_cam_ccbq and without (b) clearing mfisc->mfi_cam_start. Both consequences are statically certain and are demonstrated by a userspace mirror of the exact choreography run on the DragonFly guest:

1. V1 — ccb leak / unrecoverable hang. ccbs accepted by mfip_cam_action XPT_SCSI_IO (mfi_cam.c:242) park on mfi_cam_ccbq whenever the controller has no free command (mfip_start returns NULL at mfi_cam.c:268-269 without dequeuing). xpt_bus_deregister walks the devq/device ccbqs (cam_xpt.c:4402-4421) — it never sees SIM-private entries; the XXX at cam_xpt.c:4383 states AC_LOST_DEVICE "does not precisely abort the pending requests". And mfip_cam_action has no XPT_ABORT case (default → CAM_REQ_INVALID, mfi_cam.c:246-248), so neither CAM nor the SIM ever completes the leaked ccb: the issuing peripheral (probe/pass/ses) blocks forever, the ccb memory leaks, and mfip_detach/kldunload cannot be completed cleanly.
2. V2 — stale callback. mfi_pci_detach deletes children first (mfi_pci.c:328) and only afterwards quiesces the controller (EVENTHANDLER_DEREGISTER/mfi_shutdown/mfi_free at :332-335). In that window every completion calls mfi_startio (mfi.c:1245), which pops mfi_cam_ccbq through mfisc->mfi_cam_start (mfi.c:2132-2133) — still mfip_start, whose sim was just freed. On kldunload of mfip/mfi the callback target is unmapped linker text (call to freed kernel text).
3. V3 — completion through deregistered CAM state. The late mfip_done runs xpt_done(ccb) (mfi_cam.c:378) after the bus was deregistered: xpt_done dispatches via ccb->ccb_h.path->bus->sim (cam_xpt.c:4898), retargeted to cam_dead_sim at cam_xpt.c:4456, and reads path->periph->type — periphs of "aborted" ccbs were destroyed by the deregistration asyncs; a ccb CAM believed aborted (but which was actually leaked in our queue) completes against freed periph state — a use-after-free-shaped CAM state violation.

Why the mirror is faithful

• cam_sim_alloc takes its own devq ref (cam_sim.c:185) and never fails (M_INTWAIT); cam_simq_release after alloc is correct — modeled.
• xpt_bus_register bumps sim refcount (cam_xpt.c:4322); deregister retargets bus->sim to dead_sim (4456) and drops the ref (4484); cam_sim_free (cam_sim.c:229-234) frees at refcount 1 — modeled.
• mfip_attach/mfip_cam_action/mfip_start/mfi_startio structures are the verbatim stock code paths (pointers/locks simplified, queue and callback semantics exact).

Result (guest, 2 runs + fixed variant)

BUGGY: 4 violations (V1 leak count 3, V2 stale cb, V3 xpt_done UAF line, unmapped-text call). FIXED (drain + mfi_cam_start = NULL): 0 violations. fix.diff additionally compiles into mfip.ko on the guest with -Werror (fix_build.log).

Why not a kernel-path reproduction

Requires an LSI MegaRAID SAS controller: mfip only exists as a child of mfi (mfi.c:737), which only probes on LSI PCI IDs. The guest has zero 0x1000-vendor PCI devices and QEMU has no MegaRAID device model (env.txt). Status inconclusive per the family precedent (DF-4438, same-shape mrsas_cam finding).

Impact ceiling (honest)

On real hardware: permanent uninterruptible hang of any thread waiting on a passthrough ccb + kernel ccb leak at every detach with queued ccbs (boot-scan INQUIRYs and camcontrol traffic both queue here), and post-detach dispatch of stale ccbs through freed sim/unmapped module text / deregistered periph state — a UAF-shaped escalation surface, though no controlled write was demonstrated. Trigger requires MegaRAID hardware + pending mfip-bus ccb at detach/unload (root-initiated action, or surprise removal / shutdown race).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.