⬢ DragonFlyBSD Kernel Audit
DF-3570 / trigger.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
/* DF-3570 — source-level trigger sketch.
 *
 * On real Realtek RTL8168FP / RTL8117 silicon (PCI 10ec:8168 with TCR
 * version field 0x54900000/0x54A00000/0x54B00000 => MACFG_70/71/72) the
 * DragonFly re(4) attach path panics before the interface ever comes up:
 *
 *   re_attach (if_re.c)
 *     -> rtl_check_mac_version (re_type = MACFG_70..72)
 *     -> rtl_init_software_variable
 *          re_init_software_variable()
 *            sc->HwSuppDashVer = 3                      (re.c:4413-4417)
 *            sc->re_dash = re_check_dash(sc)            (re.c:4448-4449)
 *            CmacMemPhysAddress =
 *                MP_ReadOtherFunPciEConfigSpace(...)    (re.c:4456)  == 0xffffffff (BUG)
 *            -> bus_space_map() never called            (re.c:4457-4473 skipped)
 *            sc->re_cmac_handle = NULL                  (re.c:4487)
 *     -> rtl_exit_oob
 *          re_exit_oob()
 *            case MACFG_70/71/72: Dash2DisableTxRx(sc)   (re.c:3588-3596)
 *              Dash2DisableTx()
 *                RE_CMAC_READ_1(sc, RE_CMAC_IBCR2)      (re.c:3454)
 *                  -> bus_space_read_1(NULL, NULL, 0xF9)
 *                  -> *(volatile u_int8_t *)0xF9        (cpu/x86_64/include/bus_dma.h:135)
 *                  -> kernel page fault at attach       => PANIC
 *
 * There is nothing to "run" from userland: the fault is deterministic at
 * device attach.  The PoC for a machine that owns such a NIC is simply:
 *
 *   # kldload if_re        (or boot with the device present / module in loader.conf)
 *
 * The audit QEMU guest has only virtio-net hardware (see env.txt), so the
 * path cannot execute there; this file documents the exact trigger and the
 * mechanical source proof lives in proof.sh / VERDICT.md.
 */
int main(void) { return 0; }