DF-5463 — PTIOCSETTIMEOUT signed-multiply overflow

ptioctl() (sys/bus/cam/scsi/scsi_pt.c:648-656) stores

softc->io_timeout = *(int *)addr * 1000;      /* :654 */

with no upper bound. For *(int*)addr > 2147483 the int multiply overflows (UB) and io_timeout goes negative; PTIOCGETTIMEOUT (:642-646) maps anything < 1000 ms to 0, so the wrap is directly observable from userland. The negative value is later consumed as a u_int32_t CDB timeout in ptstart() :483 → scsi_send_receive() :691 (cam_fill_csio timeout) — a garbage (negative-wrapped) timeout instead of a rejection.

Root-gated knob self-corruption (no memory-safety impact): hardening / correctness finding.

Prereq

Guest kernel with device pt (see ../DF-5462/README.md) and the ptsim rig attached (pt0 present).

Reproduce (guest, root)

./build.sh
./run.sh

Expected

set=100000     -> get=100000 (expect 100000)
set=2147483    -> get=2147483 (expect 2147483)
set=2147484    -> get=0      (expect 2147484; 0 == OVERFLOWED to negative)
OVERFLOW-MANIFEST: io_timeout wrapped negative

DF-5463 VERDICT

Status: REPRODUCED (deterministic), fix validated on the guest

Root cause

ptioctl() PTIOCSETTIMEOUT (sys/bus/cam/scsi/scsi_pt.c:648-656):

if (*(int *)addr < 1) {          /* only the LOWER bound is checked */
        error = EINVAL;
        break;
}
softc->io_timeout = *(int *)addr * 1000;   /* :654 signed overflow */

For *(int *)addr >= 2147484 the int multiply wraps (UB) and softc->io_timeout goes negative. It is consumed as a u_int32_t millisecond CDB timeout by ptstart() :483 → scsi_send_receive() :691 (cam_fill_csio timeout) — e.g. 2147484 becomes -2147483296 → 0x8007A120 as u_int32 (a ~35.8 minute-wall-clock... as far in the wrong direction as the value allows; the point is the driver accepted and silently mangled it). PTIOCGETTIMEOUT (:642-646) maps any io_timeout < 1000 to 0, making the wrap directly observable:

Reproduced (guest, root, EVILPT kernel #0 / unfixed)

run.log:

set=100000     -> get=100000
set=2147483    -> get=2147483
set=2147484    -> get=0          <-- wrapped negative
OVERFLOW-MANIFEST: io_timeout wrapped negative

Impact ceiling

Root-gated knob self-corruption (the caller already passed caps_priv_check_self(SYSCAP_RESTRICTEDROOT) at open): no memory safety impact, no cross-privilege effect. Signed-overflow UB / silent-misconfiguration hardening finding (Info).

Fix validated (guest, kernel #1 22:30:30 with fix.diff)

fix.diff rejects *(int *)addr > 2147483 (INT_MAX/1000) with EINVAL. run.patched.log:

set=100000     -> get=100000
set=2147483    -> get=2147483
set=2147484    -> get=2147483    <-- rejected, previous value kept;
                                     no OVERFLOW-MANIFEST line

The overflow manifestation is gone; in-range behavior unchanged.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.