⬢ DragonFlyBSD Kernel Audit
DF-2316 / pnph.h
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
/*
 * pnph.h -- shared ioctl definitions for the pnpparse.c verification
 * harness (kernel pnp_harness.c + userland pnphctl.c).
 *
 * Target: DF-2316 (sys/bus/isa/pnpparse.c) -- pnp_parse_desc() reads
 * fixed descriptor offsets with only the card-declared length checked
 * upstream, so a truncated/len-0 descriptor forces OOB reads (max 17
 * bytes for PNP_TAG_MEMORY32_RANGE) past the descriptor, and -- when the
 * descriptor sits at the end of the kmalloc'd card stream buffer (or a
 * page boundary) -- past the heap allocation / into unmapped KVA.
 */
#ifndef _PNPH_HARNESS_H
#define _PNPH_HARNESS_H

#include <sys/ioccom.h>
#include <sys/types.h>

/* scenario numbers */
#define PNPH_SC_LAYOUT		9	/* struct/offset + tag-width table */
#define PNPH_SC_SWEEP		20	/* direct pnp_parse_desc, len=0 vs len=need */
#define PNPH_SC_CANRD		21	/* canary chunk: MEM32_RANGE len0 read */
#define PNPH_SC_CANWR		22	/* canary chunk: IO_RANGE len0 res[5]=1 write */
#define PNPH_SC_E2E		23	/* real pnp_parse_resources; arg = 1|2|3 */
#define PNPH_SC_WELL		24	/* well-formed stream; A/B reference dump */
#define PNPH_SC_PGFLT		25	/* page-boundary len0 parse -> fatal fault */
#define PNPH_SC_PGCTL		26	/* page-boundary control (full len 17) */

/* e2e variants (arg) */
#define PNPH_E2E_MARKERS	1	/* markers past logical stream end */
#define PNPH_E2E_PASTALLOC	2	/* descriptor at exact chunk end + canary chunk */
#define PNPH_E2E_RESIDUE	3	/* uninitialized heap residue -> resource fields */

struct pnph_req {
	uint32_t	scenario;
	uint32_t	arg;

	/* out */
	uint32_t	o_rc;
	char		o_tagname[24];
	uint32_t	o_declared;	/* declared len used in the call */
	uint32_t	o_needlen;	/* bytes the handler dereferences */
	uint32_t	o_attrib;	/* max 0-based byte offset attributed */
	uint32_t	o_nfields;
	uint32_t	o_field[40];	/* parsed field values, tag order */
	uint32_t	o_expect[40];	/* expected values from the marker bytes */
	uint32_t	o_pass;		/* all o_field == o_expect */

	uint64_t	o_chunk1, o_chunk2;	/* canary rig chunk addresses */
	uint32_t	o_before[8];		/* canary bytes before parse */
	uint32_t	o_after[8];		/* canary bytes after parse */
	uint32_t	o_wrote;		/* canary byte 0x00 -> 0x01 observed */
	uint32_t	o_leakraw[8];		/* raw OOB bytes dumped (e2e) */
	char		o_child[32];
};

#define PNPHIOC_RUN	_IOWR('P', 1, struct pnph_req)

#endif /* !_PNPH_HARNESS_H */