/* * harness.c - Userspace replication of the unbounded attribute walk in * ntfs_loadntnode() (sys/vfs/ntfs/ntfs_subr.c:305-320). * * WHY A HARNESS * ------------- * The live NTFS trigger (mount_ntfs on a crafted image) reaches the buggy * loop at mount time before the DF-0786 lockmgr panic (which only fires on * directory LOOKUP, not on the initial MFT load). But on a default GENERIC * kernel the OOB-read variant may or may not fault depending on what byte * pattern lives in the adjacent slab chunk; only the reclen==0 variant is * guaranteed to manifest (as a kernel hang). To make the bug deterministic * AND to demonstrate the fix in isolation, this harness reproduces the exact * walk logic with a guard page immediately after the (4096-byte) record * buffer, so any OOB read faults and any reclen==0 spins (caught by an * iteration cap that the kernel does NOT have). * * The harness mirrors the exact struct layout from sys/vfs/ntfs/ntfs.h: * struct attrhdr { u32 a_type; u32 reclen; u8 a_flag; u8 a_namelen; * u8 a_nameoff; u8 reserved1; u8 a_compression; * u8 reserved2; u16 a_index; }; // 16 bytes * * Build: cc -O2 -o harness harness.c * Run: ./harness {clean|loop|oob_attroff|oob_reclen} [apply_fix] * Exit: 0 = walk completed cleanly (end marker found, or fix rejected bad input) * 1 = iteration cap hit (would be infinite loop in kernel) * 2 = SIGSEGV caught (would be OOB read in kernel) */ #define _GNU_SOURCE #include #include #include #include #include #include #include #define REC_BYTES 4096 /* mirror ntm_bpmftrec=8 sectors for our image */ #define ATTR_END 0xFFFFFFFFu #define ITER_CAP 100000 /* kernel has no cap; this catches infinite loops */ struct attrhdr { uint32_t a_type; uint32_t reclen; uint8_t a_flag; uint8_t a_namelen; uint8_t a_nameoff; uint8_t reserved1; uint8_t a_compression; uint8_t reserved2; uint16_t a_index; } __attribute__((packed)); /* Mirror of the buggy walk in ntfs_loadntnode() lines 305-320. */ static int buggy_walk(uint8_t *rec, uint16_t fr_attroff) { int off = fr_attroff; struct attrhdr *ap; unsigned iters = 0; while (1) { ap = (struct attrhdr *)(rec + off); if (ap->a_type == ATTR_END) return 0; /* clean end-of-attributes */ if (++iters > ITER_CAP) return 1; /* infinite loop (reclen==0 etc) */ /* ntfs_attrtontvattr(ap) would be called here in the kernel */ off += ap->reclen; /* UNCHECKED: no bound, no !=0 */ } } /* The proposed fix: bound the walk by the record size and reject zero/overflow. */ static int fixed_walk(uint8_t *rec, uint16_t fr_attroff, int recsz) { int off = fr_attroff; struct attrhdr *ap; unsigned iters = 0; if (off <= 0 || off >= recsz) /* NEW: bound initial offset */ return -1; while (1) { if (off + (int)sizeof(struct attrhdr) > recsz) /* NEW */ return -1; ap = (struct attrhdr *)(rec + off); if (ap->a_type == ATTR_END) return 0; if (ap->reclen < sizeof(struct attrhdr)) /* NEW: reject 0 / tiny */ return -1; if (ap->reclen > recsz - off) /* NEW: no overflow past end */ return -1; if (++iters > REC_BYTES) /* paranoia cap */ return -1; off += ap->reclen; } } /* ---- signal handling so we can catch the OOB SIGSEGV cleanly ---- */ static sigjmp_buf jb; static volatile int got_sig; static void segv_handler(int sig) { (void)sig; got_sig = SIGSEGV; siglongjmp(jb, 1); } static uint8_t *rec; /* the synthetic MFT record */ static void fill_record(const char *mode) { /* start from a clean record: resident attribute + end marker */ memset(rec, 0, REC_BYTES); uint16_t attroff = 0x48; /* mirror the sibling generator's 72 */ memcpy(rec + attroff, "\x90\x00\x00\x00", 4); /* a_type = NTFS_A_INDXROOT */ /* reclen field at attroff+4 — set per mode below */ uint32_t end = ATTR_END; memcpy(rec + attroff + 8, &end, 4); /* placeholder end marker (overwritten) */ /* place end-of-attributes marker after a 64-byte resident attr body */ uint32_t real_end = ATTR_END; memcpy(rec + attroff + 64, &real_end, 4); /* (We don't write fr_attroff into a filerec header; we pass it directly.) */ if (strcmp(mode, "clean") == 0) { uint32_t rl = 64; memcpy(rec + attroff + 4, &rl, 4); /* reclen = 64 -> next is end marker */ } else if (strcmp(mode, "loop") == 0) { uint32_t rl = 0; memcpy(rec + attroff + 4, &rl, 4); /* reclen = 0 -> infinite loop */ } else if (strcmp(mode, "oob_attroff") == 0) { /* caller will pass an out-of-range attroff to the walker */ uint32_t rl = 64; memcpy(rec + attroff + 4, &rl, 4); } else if (strcmp(mode, "oob_reclen") == 0) { uint32_t rl = 0x1000; /* reclen = 4096 -> next iter off end */ memcpy(rec + attroff + 4, &rl, 4); } else { fprintf(stderr, "unknown mode '%s'\n", mode); exit(3); } } int main(int argc, char **argv) { if (argc < 2) { fprintf(stderr, "usage: %s {clean|loop|oob_attroff|oob_reclen} [apply_fix]\n", argv[0]); return 3; } const char *mode = argv[1]; int apply_fix = (argc >= 3 && strcmp(argv[2], "apply_fix") == 0); /* Allocate the record with a guard page immediately after it, so any OOB read faults deterministically (mimicking the kernel reading past the 4096-byte kmalloc'd mfrp). */ /* DragonFly's doesn't always expose _SC_PAGESIZE; hardcode. */ long pagesz = 4096; size_t mapsz = (REC_BYTES + pagesz - 1) & ~(pagesz - 1); /* round up */ uint8_t *base = mmap(NULL, mapsz + pagesz, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (base == MAP_FAILED) { perror("mmap"); return 3; } if (mprotect(base + mapsz, pagesz, PROT_NONE) != 0) { perror("mprotect"); return 3; } /* place rec at the END of the writable region so the guard page is right after byte REC_BYTES-1 (truest mirror of kmalloc(4096) on a slab). */ rec = base + mapsz - REC_BYTES; fill_record(mode); /* install SIGSEGV handler */ struct sigaction sa, oldsa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = segv_handler; sigemptyset(&sa.sa_mask); sa.sa_flags = 0; sigaction(SIGSEGV, &sa, &oldsa); /* choose the attroff we pass to the walker */ uint16_t pass_attroff = 0x48; if (strcmp(mode, "oob_attroff") == 0) pass_attroff = 0x0FF0; /* past resident attr list, inside allocation */ got_sig = 0; int rc; if (sigsetjmp(jb, 1) == 0) { if (apply_fix) rc = fixed_walk(rec, pass_attroff, REC_BYTES); else rc = buggy_walk(rec, pass_attroff); } else { rc = 2; /* SIGSEGV caught */ } sigaction(SIGSEGV, &oldsa, NULL); const char *verdict; switch (rc) { case 0: verdict = "clean exit (end-of-attributes reached)"; break; case 1: verdict = "ITERATION CAP HIT -> would be infinite loop in kernel"; break; case 2: verdict = "SIGSEGV -> OOB read past record (into adjacent slab in kernel)"; break; case -1: verdict = "FIX REJECTED input ( EINVAL in kernel)"; break; default: verdict = "unknown"; break; } printf("mode=%-12s apply_fix=%-3d -> rc=%d %s\n", mode, apply_fix, rc, verdict); return (rc == 0 || rc == -1) ? 0 : rc; }