/* * DF-0784 deterministic harness. * * Transcribes the exact arithmetic of ext2_readlink() * (sys/vfs/ext2fs/ext2_vnops.c:1345-1357) line-for-line, using a poisoned * userland "struct inode" so the production unbounded-heap-read primitive is * demonstrated deterministically, independent of the live slab layout (which * on a GENERIC kernel manifests as a panic once copyout walks past the slab — * see panic.txt; on a production/INVARIANTS-OFF kernel the disclosure is * silent up to the first unmapped page). * * Build: cc -O2 -o harness harness.c * Run: ./harness [bufkb] (default 4 KB) */ #include #include #include #include #include /* ---- minimal mirror of the relevant kernel types ------------------------- */ typedef uint64_t u_quad_t; typedef uint64_t uint64_t; typedef uint32_t uint32_t; typedef int32_t int32_t; typedef int boolean_t; #define EXT2_NDADDR 12 #define EXT2_NIADDR 3 #define EXT2_MAXSYMLINKLEN ((EXT2_NDADDR + EXT2_NIADDR) * sizeof(uint32_t)) /* 60 */ /* Mirror of `struct inode` — only the fields touched by ext2_readlink + a few * neighbours to represent what the over-read walks into. We deliberately * make this much larger than i_shortlink so the leak has somewhere to read. */ struct inode { char padding_before[64]; /* mimic preceding struct fields */ uint64_t i_size; /* file byte count (uint64!) */ uint64_t i_blocks; uint32_t i_db[EXT2_NDADDR]; /* i_shortlink alias */ uint32_t i_ib[EXT2_NIADDR]; /* After this point in real life is the next slab object / heap residue. * We poison it so the leak content is unambiguous. */ unsigned char heap_residue[4096 - 64 - 8 - 8 - 48 - 12]; }; /* Mirror of `struct uio` (only what uiomove reads). */ struct iovec { void *iov_base; size_t iov_len; }; struct uio { struct iovec *uio_iov; int uio_iovcnt; size_t uio_resid; /* ... */ }; /* ---- exact transcription of kern_subr.c uiomove() loop -------------------- */ static int uiomove_emul(unsigned char *cp, size_t n, struct uio *uio) { struct iovec *iov; size_t cnt, tot = 0; int error = 0; while (n > 0 && uio->uio_resid) { iov = uio->uio_iov; cnt = iov->iov_len; if (cnt == 0) { uio->uio_iov++; uio->uio_iovcnt--; continue; } if (cnt > n) cnt = n; tot += cnt; /* UIO_USERSPACE + UIO_READ -> copyout */ memcpy(iov->iov_base, cp, cnt); iov->iov_base = (char *)iov->iov_base + cnt; iov->iov_len -= cnt; uio->uio_resid -= cnt; cp += cnt; } return error; } /* ---- exact transcription of ext2_vnops.c:1345-1357 ----------------------- */ static int ext2_readlink_emul(struct inode *ip, struct uio *uio, int mnt_maxsymlinklen) { int isize; /* line 1350 */ isize = ip->i_size; /* line 1352: TRUNCATES uint64 -> int */ if (isize < mnt_maxsymlinklen) { /* line 1353: signed compare */ uiomove_emul((unsigned char *)ip->i_db, /* line 1354: i_shortlink = i_db */ (size_t)isize, /* int -> size_t (SIGN EXTEND!) */ uio); return (0); } return (1); /* VOP_READ path (untaken) */ } int main(int argc, char **argv) { size_t bufsz = (argc >= 2) ? (size_t)strtoul(argv[1], NULL, 0) * 1024 : 4096; if (bufsz == 0) bufsz = 4096; /* Build a poisoned "inode" slab. */ struct inode *ip = calloc(1, sizeof(*ip)); /* Write the legit short symlink target into i_shortlink (= i_db). */ const char *target = "target_foobar_link"; /* 18 bytes */ memcpy(ip->i_db, target, strlen(target)); /* Set the corrupted on-disk-equivalent i_size: bit 31 set. */ ip->i_size = 0x0000000080000000ULL; /* Poison everything after the legit target so we can SEE the leak. */ for (size_t i = strlen(target); i < sizeof(ip->heap_residue) + sizeof(ip->i_ib); i++) { unsigned char *p = (unsigned char *)ip->i_db + i; *p = (unsigned char)(0xA0 + (i & 0x3F)); } printf("=== DF-0784 harness: ext2_readlink arithmetic transcription ===\n"); printf("ip->i_size (uint64) = 0x%016llx\n", (unsigned long long)ip->i_size); int isize_buggy = (int)ip->i_size; printf("isize (int, truncated)= %d (0x%08x)\n", isize_buggy, isize_buggy); printf("isize (int -> size_t) = 0x%016llx (sign-extended)\n", (unsigned long long)(size_t)isize_buggy); printf("EXT2_MAXSYMLINKLEN = %d\n", EXT2_MAXSYMLINKLEN); printf("isize < MAXSYMLINKLEN ? %s (TRUE => fast path TAKEN)\n", (isize_buggy < (int)EXT2_MAXSYMLINKLEN) ? "YES" : "no"); printf("user buffer size = %zu bytes\n", bufsz); unsigned char *userbuf = malloc(bufsz); struct iovec iv = { .iov_base = userbuf, .iov_len = bufsz }; struct uio uio = { .uio_iov = &iv, .uio_iovcnt = 1, .uio_resid = bufsz }; int rc = ext2_readlink_emul(ip, &uio, EXT2_MAXSYMLINKLEN); size_t copied = bufsz - uio.uio_resid; printf("readlink returned = %zu bytes (rc=%d)\n", copied, rc); printf("legit target length = %zu bytes\n", strlen(target)); if (copied > strlen(target)) { size_t leaked = copied - strlen(target); printf("[!!] LEAKED %zu bytes of fake-kernel-heap past the legit target\n", leaked); } /* Show first 64 bytes of what landed in the user buffer. */ printf("\nfirst 64 bytes of user buffer (target string then poison):\n"); for (size_t i = 0; i < 64 && i < copied; i++) { printf("%02x ", userbuf[i]); if ((i & 15) == 15) printf("\n"); } printf("\nbytes 32-64 from offset 2000 (deep into the over-read region):\n"); for (size_t i = 2000; i < 2032 && i < copied; i++) { printf("%02x ", userbuf[i]); if (((i - 2000) & 15) == 15) printf("\n"); } printf("\nlast 32 bytes of user buffer:\n"); for (size_t i = (copied > 32 ? copied - 32 : 0); i < copied; i++) { printf("%02x ", userbuf[i]); if (((i - (copied > 32 ? copied - 32 : 0)) & 15) == 15) printf("\n"); } printf("\n\nConclusion: a %d-byte int truncation of a uint64 i_size yields a\n" "size_t count of 0x%016llx; uiomove copies that many bytes from\n" "i_shortlink into user RAM, bounded only by the user buffer / the\n" "first unmapped kernel page. In the live kernel (see panic.txt) the\n" "latter ends in a vm_fault panic from ext2_readlink+0x48.\n", isize_buggy, (unsigned long long)(size_t)isize_buggy); free(userbuf); free(ip); return 0; }