⬢ DragonFlyBSD Kernel Audit
DF-2132 / df2132.h
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
/*
 * df2132.h — shared ioctl interface between the DF-2132 KLD rig and the
 * unprivileged userspace trigger.
 *
 * Finding DF-2132: dma_buf_get() (sys/dev/drm/linux_dma-buf.c:168-187)
 * returns a struct dma_buf owning ZERO f_count references (holdfp borrow
 * + dropfp return), while every drm_prime.c caller (drm_prime.c:802)
 * later calls dma_buf_put() (include/linux/dma-buf.h:110-120) which does
 * an unconditional fdrop(dmabuf->file).  Each PRIME_FD_TO_HANDLE
 * "lookup-hit" iteration therefore decrements f_count by one that nobody
 * added, driving the struct file to a premature 1->0 free while the
 * fd-table slot still references it.
 */
#ifndef DF2132_H
#define DF2132_H

#include <sys/ioccom.h>
#include <sys/types.h>

struct df2132_req {
	int32_t	fd;		/* in:  fd to operate on / out: new fd */
	int32_t	fcount_before;	/* out: dmabuf->file->f_count before put */
	int32_t	fcount_after;	/* out: after put (0 if freed inside put) */
	int32_t	release_count;	/* out: rig ops->release invocations
				       (== dmabuf_close/fo_close runs) */
	int32_t	slot_valid;	/* out: fd-table slot still non-NULL */
	int32_t	slot_is_saved;	/* out: slot points at rig_saved_fp */
	int32_t	found;		/* out: LOOKUP resolved the fd */
	int32_t sprayed;	/* out: SPRAY allocated n files */
	uint64_t fp_addr;	/* out: kernel address of fp behind fd */
	uint64_t saved_fp;	/* out: rig-recorded address of exported
				       dma_buf file (now dangling) */
};

/* NOTE payload: kprintf a short user-supplied marker to the (host-side
 * durable) serial console so decisive results survive a guest panic */
struct df2132_note {
	char	msg[72];
};

#define DF2132IOC_EXPORT	_IOWR('D', 1, struct df2132_req)
#define DF2132IOC_PUT		_IOWR('D', 2, struct df2132_req)
#define DF2132IOC_INFO		_IOWR('D', 3, struct df2132_req)
#define DF2132IOC_LOOKUP	_IOWR('D', 4, struct df2132_req)
#define DF2132IOC_SPRAY		_IOWR('D', 5, struct df2132_req)
#define DF2132IOC_NOTE		_IOWR('D', 6, struct df2132_note)

#endif /* DF2132_H */