/* * DF-0586 deterministic kernel harness. * * The race the finding describes is between hci_mtap's LIST_FOREACH walk of * the global hci_pcb list (sys/netbt/hci_socket.c:935) and hci_sdetach's * unlocked LIST_REMOVE + kfree(pcb) (sys/netbt/hci_socket.c:576-577). On a * guest with NO Bluetooth controller, hci_mtap is unreachable from userspace: * hci_send returns ENETDOWN at sys/netbt/hci_socket.c:505 (no unit), and the * netisr input path (sys/netbt/bt_input.c) only iterates hci_unit_list which * is empty. * * This harness manufactures the missing conditions deterministically: * - It allocates N fake hci_pcb objects (mirror of the private struct in * hci_socket.c:72) and inserts them into the REAL global hci_pcb list. * - A walker thread calls hci_mtap(fake_mbuf, fake_unit) in a tight loop, * exercising the exact LIST_FOREACH at hci_socket.c:935. * - A killer thread repeatedly does LIST_REMOVE + kfree(pcb, M_PCB) on one * of the fake pcbs and immediately re-inserts a fresh one — the exact * mutation hci_sdetach performs at hci_socket.c:576-577, except here * driven from another CPU without the socket layer. * * The walker and killer run on different CPUs, so the unlocked walk-vs-free * race fires within seconds. On the INVARIANTS-ON default GENERIC kernel, * kfree() poisons the freed chunk with WEIRD_ADDR (0xdeadc0de) via * chunk_mark_free in kern_slaballoc.c, so the walker's next LIST_NEXT read * returns 0xdeadc0de and the next loop iteration page-faults dereferencing * it: "Fatal trap 12: page fault while in kernel mode". * * On the PATCHED kernel: hci_mtap holds hci_pcb_lock LK_SHARED while the * killer (mimicking hci_sdetach) — IF it took the lock — would acquire * LK_EXCLUSIVE. The fix.diff adds the lock to hci_sdetach and hci_mtap; to * prove the fix works on the patched kernel we instead drive the REAL * hci_sdetach via userspace socket() / close() (see poc_race.c), which takes * the patched lock, and confirm no panic. */ #include #include #include #include #include #include #include #include #include #include #include #include #include /* * Mirror of the private hci_pcb struct from sys/netbt/hci_socket.c:72. * The layout MUST match for LIST_NEXT to read the right offset and for * hci_mtap's reads of hp_flags / hp_laddr / hp_pfilter / hp_efilter / * hp_socket to land on valid (zeroed) memory. */ struct hci_pcb { struct socket *hp_socket; unsigned int hp_flags; bdaddr_t hp_laddr; bdaddr_t hp_raddr; struct hci_filter hp_efilter; struct hci_filter hp_pfilter; LIST_ENTRY(hci_pcb) hp_next; }; LIST_HEAD(hci_pcb_list_head, hci_pcb); /* The global hci_pcb list (BSS symbol exported by netbt.ko). Its head type * is LIST_HEAD(hci_pcb_list, hci_pcb), which expands to a struct with one * member (lh_first). Our local head type matches in layout. */ extern struct hci_pcb_list_head hci_pcb; /* M_PCB used by hci_socket.c is `M_BLUETOOTH`. We reuse it so kfree() returns * the chunk to the same slab bucket as a real hci_pcb free. */ #define PCB_MALLOC_TYPE M_BLUETOOTH #define PCB_MALLOC_FLAGS (M_WAITOK | M_ZERO) #define NFAKE 32 static struct hci_unit fake_unit; /* BSS, hci_bdaddr = BDADDR_ANY */ static struct mbuf *fake_m; static struct hci_pcb *fakes[NFAKE]; static struct thread *walker_td, *killer_td; static int harness_stop = 0; static unsigned long wcycles = 0, kcycles = 0; static int harness_mode = 1; /* 0 = self-contained killer+walker * 1 = walker-only (default; for both * unpatched AND patched test where * userspace drives the real * hci_sdetach via socket()/close()) */ static int walker_cpu = 1, killer_cpu = 2; SYSCTL_NODE(_kern, OID_AUTO, df0586, CTLFLAG_RD, 0, "DF-0586 harness"); SYSCTL_ULONG(_kern_df0586, OID_AUTO, wcycles, CTLFLAG_RD, &wcycles, 0, "walker hci_mtap() calls"); SYSCTL_ULONG(_kern_df0586, OID_AUTO, kcycles, CTLFLAG_RD, &kcycles, 0, "killer remove+free+reinsert cycles"); SYSCTL_INT(_kern_df0586, OID_AUTO, mode, CTLFLAG_RD, &harness_mode, 0, "0=self-contained, 1=walker-only"); SYSCTL_INT(_kern_df0586, OID_AUTO, walker_cpu, CTLFLAG_RD, &walker_cpu, 0, ""); SYSCTL_INT(_kern_df0586, OID_AUTO, killer_cpu, CTLFLAG_RD, &killer_cpu, 0, ""); static void insert_fake(int i) { fakes[i] = kmalloc(sizeof(struct hci_pcb), PCB_MALLOC_TYPE, PCB_MALLOC_FLAGS); /* Make hci_mtap's first filter FAIL on our fake pcbs so it `continue`s * past them without dereferencing hp_socket (which is NULL). Set * hp_laddr to all-FF, while fake_unit.hci_bdaddr is all-zero, so * bdaddr_same returns false and the `continue` at line 940-941 fires. */ memset(&fakes[i]->hp_laddr, 0xff, sizeof(bdaddr_t)); /* Still unlocked insert, just like hci_sattach does at hci_socket.c:656 */ LIST_INSERT_HEAD(&hci_pcb, fakes[i], hp_next); } /* * Walker: hci_mtap() does LIST_FOREACH(&hci_pcb) and reads pcb fields. * If a pcb is concurrently freed+poisoned by the killer, the walker's * next LIST_NEXT read returns 0xdeadc0de and the subsequent pcb != NULL / * pcb->hp_next dereference faults. */ static void walker_loop(void *arg) { int tick = 0; while (!harness_stop) { hci_mtap(fake_m, &fake_unit); wcycles++; if (++tick >= 256) { tick = 0; lwkt_yield(); } } } /* * Killer: repeatedly remove + kfree one of our fake pcbs (exact same * mutation hci_sdetach performs at hci_socket.c:576-577), then re-insert a * fresh one. The walker is iterating the list concurrently on another CPU. */ static void killer_loop(void *arg) { int i = 0, tick = 0; while (!harness_stop) { i = (i + 1) % NFAKE; /* If our pcb was already removed (e.g., by killer interleave), * skip; otherwise this matches hci_sdetach:576-577 exactly. */ if (fakes[i] != NULL) { struct hci_pcb *p = fakes[i]; LIST_REMOVE(p, hp_next); kfree(p, PCB_MALLOC_TYPE); fakes[i] = NULL; insert_fake(i); kcycles++; } if (++tick >= 64) { tick = 0; lwkt_yield(); } } } static int df0586_modevent(module_t mod, int type, void *data) { int error = 0, i; switch (type) { case MOD_LOAD: /* Build a 4-byte mbuf: HCI_EVENT_PKT header (type byte + * event byte +plen byte). hci_mtap reads mtod(m,uint8_t*)[0] * for type then for HCI_EVENT_PKT reads event = byte[1]. */ fake_m = m_gethdr(M_WAITOK, MT_DATA); if (fake_m == NULL) { kprintf("df0586: m_gethdr failed\n"); return ENOMEM; } memset(mtod(fake_m, caddr_t), 0, 4); mtod(fake_m, uint8_t *)[0] = HCI_EVENT_PKT; /* event = 0 -> hci_filter_test(0, &efilter) reads mask[7]&0x80000000 * which is 0 for our zeroed fake pcbs -> filter fails -> continue. * For real pcbs (default efilter), event=0 also filters out. */ fake_m->m_len = 4; fake_m->m_pkthdr.len = 4; /* Pre-populate the global list with NFAKE entries */ for (i = 0; i < NFAKE; i++) insert_fake(i); harness_stop = 0; wcycles = kcycles = 0; /* Walker always runs */ error = kthread_create_cpu(walker_loop, NULL, &walker_td, walker_cpu, "df0586w"); if (error) goto fail; if (harness_mode == 0) { error = kthread_create_cpu(killer_loop, NULL, &killer_td, killer_cpu, "df0586k"); if (error) goto fail; kprintf("df0586_harness: self-contained mode: " "walker cpu%d + killer cpu%d racing on " "%d fake pcbs in the global hci_pcb list\n", walker_cpu, killer_cpu, NFAKE); } else { kprintf("df0586_harness: walker-only mode (cpu%d); " "NOW run userspace poc_race to drive the real " "hci_sattach/hci_sdetach\n", walker_cpu); } break; fail: harness_stop = 1; tsleep(&harness_stop, 0, "df0586e", 100); for (i = 0; i < NFAKE; i++) { if (fakes[i]) { LIST_REMOVE(fakes[i], hp_next); kfree(fakes[i], PCB_MALLOC_TYPE); fakes[i] = NULL; } } if (fake_m) { m_freem(fake_m); fake_m = NULL; } return error; case MOD_UNLOAD: harness_stop = 1; tsleep(&harness_stop, 0, "df0586u", 200); for (i = 0; i < NFAKE; i++) { if (fakes[i]) { LIST_REMOVE(fakes[i], hp_next); kfree(fakes[i], PCB_MALLOC_TYPE); fakes[i] = NULL; } } if (fake_m) { m_freem(fake_m); fake_m = NULL; } kprintf("df0586_harness unloaded: wcycles=%lu kcycles=%lu\n", wcycles, kcycles); break; default: break; } return error; } static moduledata_t df0586_mod = { "df0586_harness", df0586_modevent, NULL }; DECLARE_MODULE(df0586_harness, df0586_mod, SI_SUB_EXEC, SI_ORDER_ANY); MODULE_DEPEND(df0586_harness, netbt, 1, 1, 1); MODULE_VERSION(df0586_harness, 1);