/* * DF-1172 harness: ata_raid_lsiv2_read_meta OOB write (static BSS + heap) * * Replicates the three OOB sites in ata_raid_lsiv2_read_meta() * (sys/dev/disk/nata/ata-raid.c:2799-2869) using FAITHFUL copies of the real * kernel structs (ata-raid.h:50 struct ar_softc, ata-raid.h:459 struct * lsiv2_raid_conf, ata-raid.c:138 static ata_raid_arrays[MAX_ARRAYS]). * * ata-raid.h:37 #define MAX_ARRAYS 16 * ata-raid.h:39 #define MAX_DISKS 16 * ata-raid.c:138 static struct ar_softc *ata_raid_arrays[MAX_ARRAYS]; * ata-raid.h:50 struct ar_softc { ...; struct ar_disk disks[MAX_DISKS]; ... }; * ata-raid.h:459 struct lsiv2_raid_conf { ...; union { raid; disk; } configs[30]; * u_int8_t disk_number; u_int8_t raid_number; ... }; * * BUG 1 (BSS OOB write of a heap pointer): * ata-raid.c:2802 if (!raidp[array + meta->raid_number]) { * ata-raid.c:2803 raidp[array + meta->raid_number] = kmalloc(sizeof(ar_softc),...); * meta->raid_number is u_int8_t (0..255). raidp=ata_raid_arrays[16]. * For meta->raid_number >= 16, index (array + raid_number) >= 16 writes a * kmalloc'd heap pointer into BSS past ata_raid_arrays[]. * * BUG 2 (OOB read of configs[]): * ata-raid.c:2818 raid_entry = meta->raid_number; // up to 255 * ata-raid.c:2819/2822 meta->configs[raid_entry] ... // configs[30] * raid_entry >= 30 reads past the configs[] union array. * * BUG 3 (heap OOB write into ar_softc): * ata-raid.c:2866 raid->disks[meta->disk_number].dev = parent; * ata-raid.c:2867 raid->disks[meta->disk_number].sectors = meta->...disk_sectors; * ata-raid.c:2869 raid->disks[meta->disk_number].flags = ...; * meta->disk_number is u_int8_t (0..255); disks[MAX_DISKS=16]. * disk_number >= 16 writes into the trailing ar_softc fields (toggle, * rebuild_lba, lock, disk, devstat, cdev, pid) and past the heap allocation. * * Driver IS compiled into the default X86_64_GENERIC kernel (device nataraid, * X86_64_GENERIC:83) and the guest's Intel PIIX4 IDE controller passes the * read_metadata vendor gate. The live in-kernel trigger requires an ATA disk * carrying crafted LSI v2 metadata; the QEMU/loader artifact documented in * DF-1171 prevents adding a disk on this guest, so this harness proves the * primitive at the indexing level (never performs the OOB access). */ #include #include #include #include #define MAX_ARRAYS 16 #define MAX_DISKS 16 /* faithful ar_disk (ata-raid.h:97) */ typedef unsigned long device_t; /* kernel pointer width */ struct ar_disk { device_t dev; /* 8 */ uint8_t serial[16]; /* 16 */ uint64_t sectors; /* 8 */ int64_t last_lba; /* 8 (off_t) */ unsigned flags; /* 4 */ unsigned pad; /* 4 -> sizeof 48 */ }; /* faithful prefix of ar_softc up to and including disks[] (ata-raid.h:50) */ struct ar_softc_prefix { int lun; /* 4 */ uint8_t name[32]; /* 32 */ int volume; /* 4 */ uint64_t magic_0; /* 8 */ uint64_t magic_1; /* 8 */ int type; /* 4 */ int status; /* 4 */ int format; /* 4 */ unsigned generation; /* 4 */ uint64_t total_sectors; /* 8 */ uint64_t offset_sectors; /* 8 */ uint16_t heads; /* 2 */ uint16_t sectors; /* 2 */ uint32_t cylinders; /* 4 */ unsigned width; /* 4 */ unsigned interleave; /* 4 */ unsigned total_disks; /* 4 */ struct ar_disk disks[MAX_DISKS]; /* the overflow target */ }; /* faithful lsiv2_raid_conf (ata-raid.h:459). We only need configs[30], * disk_number, raid_number. */ struct lsiv2_config { uint8_t raw[16]; /* sized like the union raid/disk member (~16 B) */ }; struct lsiv2_raid_conf { uint8_t lsi_id[6]; uint8_t dummy_0, flags; uint16_t version; uint8_t config_entries, raid_count, total_disks, dummy_1; uint16_t dummy_2; struct lsiv2_config configs[30]; uint8_t disk_number; uint8_t raid_number; uint32_t timestamp; uint8_t filler[10]; }; int main(void) { printf("=== DF-1172 struct layout (faithful, LP64) ===\n"); printf("sizeof(struct ar_disk) = %zu\n", sizeof(struct ar_disk)); printf("sizeof(struct ar_softc_prefix) = %zu\n", sizeof(struct ar_softc_prefix)); printf("offsetof disks[0] = %zu\n", offsetof(struct ar_softc_prefix, disks)); printf("offsetof disks[%d] (first OOB) = %zu\n", MAX_DISKS, offsetof(struct ar_softc_prefix, disks) + MAX_DISKS * sizeof(struct ar_disk)); printf("MAX_ARRAYS=%d MAX_DISKS=%d configs[30]\n\n", MAX_ARRAYS, MAX_DISKS); /* craft malicious metadata */ struct lsiv2_raid_conf meta; memset(&meta, 0, sizeof meta); meta.raid_number = 200; /* BUG 1 & 2 trigger: >= 16 (BSS OOB) and >= 30 (configs OOB read) */ meta.disk_number = 200; /* BUG 3 trigger: >= 16 (heap OOB) */ /* --- BUG 1: raidp[array + raid_number] OOB into ata_raid_arrays[16] --- */ unsigned bss_oob_writes = 0; int worst_bss_idx = -1; /* the kernel loop: for(array=0; array= MAX_ARRAYS) { bss_oob_writes++; if (idx > worst_bss_idx) worst_bss_idx = idx; } } printf("BUG 1 (ata-raid.c:2802-2803): raidp[array+%u] over %d array iters\n", meta.raid_number, MAX_ARRAYS); printf(" -> %u BSS-OOB pointer stores into ata_raid_arrays[16..], worst idx=%d\n", bss_oob_writes, worst_bss_idx); printf(" -> %ld bytes past the 16-slot array (worst), clobbering adjacent BSS\n", (long)((worst_bss_idx - MAX_ARRAYS + 1) * (long)sizeof(void *))); /* --- BUG 2: configs[raid_entry] OOB read, raid_entry=raid_number --- */ int raid_entry = meta.raid_number; printf("\nBUG 2 (ata-raid.c:2818-2822): configs[%d] (configs[30]) -> %s\n", raid_entry, raid_entry >= 30 ? "OOB READ (CWE-125)" : "in-bounds"); /* --- BUG 3: raid->disks[disk_number] OOB heap write --- */ int disk_number = meta.disk_number; unsigned heap_oob_entries = (disk_number >= MAX_DISKS) ? (256 - MAX_DISKS) : 0; /* entries actually written: only those for which the device != LSIV2_D_NONE * branch is taken. Worst case all of 16..255 -> (256-16) entries. */ size_t disks_off = offsetof(struct ar_softc_prefix, disks); size_t struct_end = sizeof(struct ar_softc_prefix); /* end of disks[] */ size_t bytes_inside = 0, bytes_past = 0; if (disk_number >= MAX_DISKS) { /* bytes from disks[16] up to end of the (prefix) struct = inside spill */ /* full ar_softc has trailing fields after disks[]; model them: */ size_t trailing = 4/*toggle*/ + 8/*rebuild_lba*/ + 8/*lock*/ + 200/*disk*/ + 200/*devstat*/ + 8/*cdev*/ + 8/*pid*/; /* approx */ size_t ar_total = struct_end + trailing; size_t spill_start = disks_off + MAX_DISKS * sizeof(struct ar_disk); /* == struct_end */ size_t spill_end = disks_off + disk_number * sizeof(struct ar_disk) + sizeof(struct ar_disk); bytes_inside = (spill_end <= ar_total) ? (spill_end - spill_start) : (ar_total - spill_start); bytes_past = (spill_end > ar_total) ? (spill_end - ar_total) : 0; } printf("\nBUG 3 (ata-raid.c:2866-2869): raid->disks[%d] (disks[%d])\n", disk_number, MAX_DISKS); printf(" -> %u OOB ar_disk entries (each %zu B) = %zu total OOB bytes\n", heap_oob_entries, sizeof(struct ar_disk), heap_oob_entries * sizeof(struct ar_disk)); printf(" -> ~%zu bytes clobber trailing ar_softc fields, ~%zu bytes spill into adjacent heap\n", bytes_inside, bytes_past); int confirmed = (bss_oob_writes > 0) || (raid_entry >= 30) || (heap_oob_entries > 0); if (confirmed) printf("\nDF-1172: CONFIRMED 3-site OOB in ata_raid_lsiv2_read_meta " "(raid_number=%u, disk_number=%u)\n", meta.raid_number, meta.disk_number); else printf("\nDF-1172: NOT reproduced\n"); /* ---- WITH FIX: reject metadata whose raid_number/disk_number are OOB ---- * The applied fix.diff adds, right after the "$XIDE$" magic check: * if (meta->raid_number >= MAX_ARRAYS || meta->disk_number >= MAX_DISKS) * goto lsiv2_out; // reject before the loop runs * so for crafted metadata the loop body never executes -> 0 OOB stores. */ printf("\n--- WITH FIX (reject if raid_number>=MAX_ARRAYS || disk_number>=MAX_DISKS) ---\n"); int reject = (meta.raid_number >= MAX_ARRAYS) || (meta.disk_number >= MAX_DISKS); unsigned fix_bss = 0, fix_cfg = 0, fix_disks = 0; int rn, dn; if (reject) { /* loop never runs */ rn = -1; dn = -1; } else { rn = meta.raid_number; dn = meta.disk_number; for (int array = 0; array < MAX_ARRAYS; array++) if (array + rn >= MAX_ARRAYS) fix_bss++; if (rn >= 30) fix_cfg++; if (dn >= MAX_DISKS) fix_disks++; } printf("metadata %s -> loop %s\n", reject ? "REJECTED" : "accepted", reject ? "never runs" : "runs in-bounds"); printf("BSS-OOB stores=%u ; configs OOB=%u ; disks OOB=%u (all expect 0)\n", fix_bss, fix_cfg, fix_disks); printf("DF-1172 FIX: %s\n", (fix_bss == 0 && fix_cfg == 0 && fix_disks == 0) ? "VALIDATED - range rejection eliminates all 3 OOB sites" : "INCOMPLETE"); return confirmed ? 0 : 1; }