DF-5013 — mfi LD lifetime: softc freed under open descriptors and in-flight bios

What

Every path that deletes an mfi logical-disk child device frees the struct mfi_disk softc (newbus: device_delete_child → device_detach → device_set_driver(dev, NULL) → kfree(dev->softc), sys/kern/subr_bus.c:2127-2130, :2146) while the cdev may still be reachable and while bios for that volume may still be in flight:

1. AEN path — no gate at all (mfi.c:1494-1510, mfi_decode_evt, MR_EVT_LD_STATE_CHANGE → new_state OFFLINE): device_delete_child() directly — no mfi_disk_disable(), no OPEN check, no drain. A volume going offline (drive failure/pull, foreign import, firmware decision) frees the softc while userland holds open fds on /dev/mfidN (root:operator 0640 — sys/kern/subr_disk.c) and/or while its bios sit on mfi_bioq / the controller busy queue.
2. ioctl path (mfi.c:2623-2638, mfi_check_command_post, MFI_DCMD_LD_DELETE / MFI_DCMD_CFG_CLEAR): the pre-check (mfi_check_command_pre, mfi.c:2570-2578) calls mfi_disk_disable(), which refuses when the ld is OPEN — but that flag is advisory and the post-path never re-checks; bios already in flight at pre-check time are never drained either.
3. mfi_disk_detach() itself (mfi_disk.c:171-194): the OPEN check returns EBUSY only when mfi_keep_deleted_volumes || mfi_detaching (both default 0, mfi.c:729-734) — i.e. by default detach proceeds even with the disk OPEN — and nothing waits for ld_active-style in-flight accounting because none exists.

After the softc is freed: - mfi_disk_complete() (mfi_disk.c:304-320) later runs for any in-flight bio (bio->bio_driver_info = sc, set at mfi_disk.c:295) → write-after-free (devstat_end_transaction_buf(&sc->ld_devstat, bp)) and read-after-free (diskerr(bio, sc->ld_disk.d_cdev, ...)). - any descriptor that raced open (devfs unlink is asynchronous relative to disk_destroy(), which itself only synchronizes on the disk-core message: subr_disk.c:876-880 → devfs_core.c:755-763) → next read/write/close runs mfi_disk_strategy/close against si_drv1 pointing into the freed softc.

Threat model

Raw mfid nodes are root:operator 0640. An operator-group user holding /dev/mfidN open (or with AIO in flight) when the volume goes OFFLINE — a hardware event, no privileged ioctl required — gets kernel heap UAF. The same operator can drive path 2 directly via MFI_CMD LD_DELETE (0660 on /dev/mfi0, mfi.c:721-724), sacrificing a scratch volume. Destructive but single-actor-controlled, and the corruption primitive (freed softc deref by strategy/completion) is attacker-timing-controlled.

Reproduction status

HW-gated: the audit guest has no MegaRAID controller, so the mfi attach/lifecycle cannot run here. The mechanism is source-proven end-to-end (softc kfree site, completion deref site, missing gates — see VERDICT.md). No runtime PoC possible on this guest; this matches the DF-2066/DF-3898 house treatment of HW-gated driver bugs.

Fix

fix.diff (git-apply-able, 3 files): - mfivar.h: ld_active in-flight counter (guarded by mfi_io_lock). - mfi_disk.c: strategy fails new bios with ENXIO once DISABLED; counts in-flight bios; mfi_disk_complete() decrements and wakes; mfi_disk_detach() sets DISABLED and drains (lksleep) before disk_destroy(). - mfi.c AEN path: mfi_disk_disable() gate before device_delete_child() (refuse while open), mirroring the ioctl pre-path.

DF-5013 — VERDICT

Status: NOT REPRODUCED at runtime — hardware-gated (no LSI MegaRAID controller on the audit guest; mfi cannot attach). The defect is source-proven end-to-end: every link in the chain below is unconditional, cited control flow in the audited tree (same commit the guest kernel was built from). This is the same standard applied to DF-2066 and DF-3898.

Impact ceiling: kernel heap use-after-free (write-after-free via devstat_end_transaction_buf on the freed softc; read + indirect call through freed si_drv1 via the disk ops). Realistic weaponization: operator-group user (raw mfid nodes are root:operator 0640) racing an open fd / in-flight read against a volume-offline event or LD_DELETE → freed-softc deref → slab-groom → object forge → uid=0. The race window is the firmware round-trip of the deleting DCMD (milliseconds) for the ioctl path, and zero (no gate) for the AEN path — an fd that is already open when the AEN delete lands is enough; the next I/O on it hits the freed softc.

Chain (all citations from the audited tree)

1. Softc free site: device_delete_child(sc->mfi_dev, ld->ld_dev) (mfi.c:1508 AEN path, mfi.c:2633 LD_DELETE post-path, mfi.c:2644 CFG_CLEAR post-path) → device_detach (subr_bus.c:2140-2152) → device_set_driver(dev, NULL) (subr_bus.c:2146) → kfree(dev->softc, M_BUS) (subr_bus.c:2127-2130). The struct mfi_disk is the driver softc (mfi_disk.c:80-84, sizeof(struct mfi_disk)).
2. Missing gates: - AEN: mfi.c:1494-1510 — device_delete_child with no mfi_disk_disable, no OPEN check, no drain (the old KASSERT here is commented out). - ioctl post: mfi.c:2630-2635 — no re-check between the pre-check (mfi.c:2570-2578) and the delete; pre-check's disable is advisory. - mfi_disk_detach: mfi_disk.c:178-185 — EBUSY only when mfi_keep_deleted_volumes || mfi_detaching (defaults 0, mfi.c:729-734); no in-flight accounting exists to drain even if it wanted to.
3. UAF consumers: - mfi_disk_complete (mfi_disk.c:304-320), reached from mfi_bio_complete (mfi.c:2092-2115, called under mfi_io_lock from mfi_complete): writes sc->ld_devstat inside the freed softc (mfi_disk.c:310), reads sc->ld_disk.d_cdev (mfi_disk.c:314). - any raced-open descriptor: si_drv1 (set mfi_disk.c:149) still points into the freed softc; mfi_disk_strategy derefs sc->ld_controller (mfi_disk.c:264) and mfi_disk_open/close take &sc->ld_controller->mfi_io_lock (mfi_disk.c:202, 219) — lockmgr on a pointer read from freed memory. Devfs unlink is asynchronous (destroy_dev → devfs_destroy_dev posts a message, devfs_core.c:755-763), and disk_destroy only synchronizes the disk-core message (subr_disk.c:876-880, :527-556) — neither revokes an fd that already holds a cdev reference.
4. Bios in flight with OPEN clear: an in-flight bio does not require the fd's d_close to have happened (vnode/fp refs), but the final-in-flight / AIO / post-umount-buffer windows leave exactly that state; the AEN path (1) additionally doesn't care about OPEN at all.

Exploit chain (design, not exercised — no hardware on guest)

operator (or any user if an admin-configured volume goes offline while they hold an fd): hold O_RDONLY fd on /dev/mfidN → trigger offline (pull last drive of RAID0 / operator LD_DELETE on scratch volume) → AEN delete frees softc → keep issuing pread()s on the held fd → strategy derefs freed softc → heap groom (the 0x...-sized softc slab) → forge ld_controller pointer / victim object → lockmgr/devstat writes give a controlled write primitive → uid=0. Deterministic-UAF variant: park a large AIO read, force OFFLINE, completion path writes into freed softc.

Fix

fix.diff — in-flight accounting (ld_active) + DISABLED gate in strategy + drain-before-destroy in mfi_disk_detach + mfi_disk_disable() gate on the AEN delete path. git apply --check clean against the tree. Not built as a single-fix kernel: entry is hardware-gated (no mfi controller on guest), so a patched-kernel run could not exercise the path — fix validated by inspection only.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.