/* * DF-3755 — dangling rdev->pm.dpm.ps after alloc-failure free in * ni_parse_power_table -> double free in ni_dpm_fini + UAF * (radeon Northern Islands DPM, sys/dev/drm/radeon/ni_dpm.c) * * radeon twin of si_dpm DF-3611 / ci_dpm DF-3645 (amdgpu DF-3588/3624). * * ni_parse_power_table (ni_dpm.c:4008-4042): when the kzalloc of a state's * struct ni_ps fails at iteration i=k, the error path does * * ni_dpm.c:4020-4024 * ps = kzalloc(sizeof(struct ni_ps), GFP_KERNEL); * if (ps == NULL) { * kfree(rdev->pm.dpm.ps); // freed, pointer NOT nulled * return -ENOMEM; // num_ps never set (stays 0) * } * * Three consequences, all confirmed by this harness against a faithful * replica of the call graph: * * (1) rdev->pm.dpm.ps dangles. radeon_pm_init_dpm() IGNORES the * dpm.init return value (radeon_pm.c:1448, macro radeon.h:2793 — * called as a bare statement) and immediately executes * radeon_pm.c:1449 current_ps = requested_ps = boot_ps * — boot_ps points INTO the freed array whenever a BOOT-classified * state was parsed at index < k, so current_ps/requested_ps dangle * too. radeon_pm_init's error is then swallowed again by the asic * init (ni.c:2432 `radeon_pm_init(rdev);` — value ignored), the * driver keeps loading, and radeon_dpm_enable() runs the UAF read * chain ni_dpm_enable:3589/3641 -> ni_init_smc_table:1943/1975 -> * ni_get_ps(freed)->ps_priv -> ni_get_ps(freed ps_priv)->count. * * (2) rdev->pm.dpm.num_ps stays 0 (it is only assigned at ni_dpm.c:4041 * on success), so the k already-parsed ps_priv allocations leak * permanently (ni_dpm_fini's loop runs 0 times). * * (3) At driver teardown (radeon_device_fini -> radeon_fini -> ni.c:2489 * radeon_pm_fini -> radeon_pm.c:1705 radeon_dpm_fini — NOT guarded by * dpm_enabled), ni_dpm_fini executes * ni_dpm.c:4273 kfree(rdev->pm.dpm.ps); // SECOND free -> corruption * Because the freed slab object can already have been reallocated by * any other kernel subsystem in the interim, this is a classic * use-after-free free(): with a kmalloc'd victim in between, kfree * releases a LIVE object of another subsystem. * * No AMD NI GPU exists on the QEMU audit guest (virtio-only), so this * harness replicates the exact sequence with malloc/free and demonstrates: * [A] the dangling assignment current_ps = boot_ps = &freed_ps[k']; * [B] the UAF read through boot_ps after another allocation reuses the * chunk (attacker-influenced garbage flows into the DPM enable path); * [C] the teardown double free — glibc detects and aborts; DragonFly's * kmalloc does NOT detect it and corrupts the zone instead; * [C2] with a live victim object reusing the chunk, ni_dpm_fini's kfree * frees the victim while it is still in use (malloc hands the same * address out again immediately); * [D] the fixed path (fix.diff): ps_privs freed, pointer nulled, error * propagated — no leak, no dangling, no double free, no enable. */ #include #include #include #include #include #include #include #include #define ATOM_PPLIB_CLASSIFICATION_BOOT 0x0008 /* struct radeon_ps (radeon.h:1342-1356) */ struct radeon_ps { uint32_t caps; uint32_t class; uint32_t class2; uint32_t vclk; uint32_t dclk; uint32_t evclk; uint32_t ecclk; uint8_t vce_active; uint8_t _pad[3]; int32_t vce_level; void *ps_priv; /* offset 0x28 on LP64 */ }; struct rv7xx_pl { uint32_t mclk, sclk, vddc, vddci, flags; }; struct ni_ps { uint16_t performance_level_count; uint8_t dc_compatible; struct rv7xx_pl performance_levels[16]; }; struct dpm_state { struct radeon_ps *ps; /* rdev->pm.dpm.ps */ int num_ps; /* rdev->pm.dpm.num_ps */ struct radeon_ps *boot_ps; /* rdev->pm.dpm.boot_ps */ struct radeon_ps *current_ps; /* rdev->pm.dpm.current_ps */ struct radeon_ps *requested_ps; /* rdev->pm.dpm.requested_ps */ } dpm; static int fail_alloc_at = -1; /* kzalloc failure injection */ static int allocs; /* kzalloc counter */ static void *kzalloc_rep(size_t n) { if (allocs++ == fail_alloc_at) { printf(" [kzalloc #%d fails — memory pressure]\n", allocs - 1); return NULL; } return calloc(1, n); } /* -------- ni_parse_power_table (ni_dpm.c:3985-4042), ni shapes -------- */ static int ni_parse_power_table(int num_states, int boot_state_index, int entry_idx_boot) { struct ni_ps *ps; int i; dpm.ps = calloc(num_states, sizeof(struct radeon_ps)); /* :4003 */ allocs = 0; for (i = 0; i < num_states; i++) { if (i == boot_state_index) { /* non-clock info of this state is BOOT-classified */ dpm.ps[i].class = ATOM_PPLIB_CLASSIFICATION_BOOT; dpm.boot_ps = &dpm.ps[i]; /* :3914-3915 */ printf(" state %d classified BOOT -> boot_ps = &ps[%d] " "(inside dpm.ps @ %p)\n", i, i, (void *)dpm.ps); } ps = kzalloc_rep(sizeof(struct ni_ps)); /* :4020 */ if (ps == NULL) { free(dpm.ps); /* :4022 dangles! */ return -ENOMEM; /* num_ps stays 0 */ } dpm.ps[i].ps_priv = ps; /* :4025 */ } dpm.num_ps = num_states; /* :4041 never reached */ return 0; } /* ni_get_ps (ni_dpm.c:733-737) */ static struct ni_ps *ni_get_ps(struct radeon_ps *rps) { return rps->ps_priv; } /* ni_populate_smc_initial_state first data use (ni_dpm.c:1683/1707) */ static uint32_t first_deref(struct radeon_ps *boot) { struct ni_ps *initial_state = ni_get_ps(boot); return initial_state->performance_levels[0].mclk; } /* ni_dpm_enable (ni_dpm.c:3589/3641/1943/1975) */ static int ni_dpm_enable(void) { struct radeon_ps *boot_ps = dpm.boot_ps; /* :3589 */ return (int)first_deref(boot_ps); /* UAF read chain */ } /* ni_dpm_fini (ni_dpm.c:4266-4273) */ static void ni_dpm_fini(void) { int i; for (i = 0; i < dpm.num_ps; i++) /* num_ps == 0: leak! */ free(dpm.ps[i].ps_priv); free(dpm.ps); /* :4273 double free */ } /* radeon_pm_init_dpm (radeon_pm.c:1448-1453) — rc IGNORED replica */ static int radeon_pm_init_dpm(int num_states, int boot_state_index, int fail_at) { int ret; dpm.boot_ps = NULL; dpm.num_ps = 0; fail_alloc_at = fail_at; /* memory-pressure injection */ ret = ni_parse_power_table(num_states, boot_state_index, 0); (void)ret; /* :1448 — return value discarded */ dpm.current_ps = dpm.requested_ps = dpm.boot_ps; /* :1449 */ ret = ni_dpm_enable(); /* :1453 */ return ret; } static volatile uint32_t sink; int main(void) { printf("== DF-3755 harness: ni_parse_power_table alloc-failure dangling free ==\n\n"); /* * Crafted-VBIOS shape: 8 states; state 2 is BOOT-classified; * struct ni_ps kzalloc fails at i=5 (heap pressure at load). */ printf("[A] parse: 8 states, state[2] BOOT, kzalloc fails at i=5\n"); int rc = radeon_pm_init_dpm(8, 2, 5); printf(" ni_dpm_init returned -ENOMEM, radeon_pm.c:1448 ignores it;\n" " ni_dpm_enable() then ran the UAF chain and returned %d\n", rc); printf(" radeon_pm.c:1448 ignores dpm.init rc; :1449 assigns\n" " current_ps = requested_ps = boot_ps = %p (DANGLING: ps array freed at ni_dpm.c:4022)\n" " num_ps = %d (never set -> ps_priv[0..4] leak permanently)\n", (void *)dpm.boot_ps, dpm.num_ps); printf(" radeon_pm_init error swallowed at ni.c:2432 -> driver keeps loading\n"); /* * [B] UAF: another kernel allocation reuses the freed chunk before * dpm enable runs (driver load does thousands of allocations). * The reuse writes its own data into the chunk — including the slot * the driver still reads as boot_ps->ps_priv — so attacker-influenced * bytes flow straight into the DPM enable path. */ printf("\n[B] UAF read through boot_ps after slab reuse\n"); size_t psz = 8 * sizeof(struct radeon_ps); struct ni_ps fake_ni_ps; /* "attacker-influenced" reuse */ memset(&fake_ni_ps, 0, sizeof(fake_ni_ps)); fake_ni_ps.performance_level_count = 1; fake_ni_ps.performance_levels[0].mclk = 0xdeadbee; char *victim = malloc(psz); /* "another subsystem" */ printf(" victim alloc (%zu bytes) = %p (reuse: %s)\n", psz, (void *)victim, (void *)victim == (void *)dpm.ps ? "SAME chunk" : "different chunk"); memset(victim, 0xA5, psz); /* victim writes a valid-looking pointer where ps[2].ps_priv lived */ *(void **)(victim + 2 * sizeof(struct radeon_ps) + offsetof(struct radeon_ps, ps_priv)) = &fake_ni_ps; fflush(stdout); pid_t p = fork(); if (p == 0) { sink = ni_dpm_enable(); /* reads freed/reused chunk */ printf(" ni_dpm_enable consumed reused-chunk data: mclk=0x%x\n" " (kernel: garbage/attacker data drives the DPM state machine)\n", (uint32_t)sink); fflush(stdout); _exit(0); } int st = 0; waitpid(p, &st, 0); printf(" (deeper derefs of reused-chunk pointers fault -> panic)\n"); free(victim); /* * [C] teardown double free, immediate (no realloc between). * DragonFly's jemalloc — like the kernel's kmalloc — does NOT abort * on a double free; the chunk enters the free bin twice. We prove * the corruption deterministically: two subsequent allocations of * the same size return the SAME address (live alias). */ printf("\n[C] teardown: ni.c:2489 radeon_pm_fini -> ni_dpm_fini ->\n" " kfree(rdev->pm.dpm.ps) on the dangling pointer (double free)\n"); fflush(stdout); p = fork(); /* flush already done above */ if (p == 0) { size_t psz2 = 8 * sizeof(struct radeon_ps); /* fresh dangling scenario for a clean double free */ dpm.boot_ps = NULL; dpm.current_ps = NULL; dpm.requested_ps = NULL; dpm.num_ps = 0; fail_alloc_at = 5; int rc2 = ni_parse_power_table(8, -1, 0); (void)rc2; /* fails @5, frees ps */ ni_dpm_fini(); /* second free: chunk in bin twice */ void *x1 = malloc(psz2), *x2 = malloc(psz2); printf(" post-corruption allocations: x1=%p x2=%p -> %s\n", x1, x2, x1 == x2 ? "ALIAS (same chunk handed out twice)" : "distinct"); printf(" >>> kernel kmalloc: same silent bin corruption;\n" " two subsystems now share one live object <<<\n"); fflush(stdout); _exit(0); } st = 0; waitpid(p, &st, 0); printf(" (child %d — no abort: the corruption is silent, as in-kernel)\n", WIFSIGNALED(st) ? WTERMSIG(st) : WEXITSTATUS(st)); /* * [C2] double free with a live victim in between: kfree releases the * victim while it is still in use. */ printf("\n[C2] double free with live victim: kfree(dangling) frees victim\n"); struct radeon_ps *ps2 = calloc(8, sizeof(struct radeon_ps)); struct radeon_ps *dangling = ps2; free(ps2); /* "parse failure" free */ char *vic = malloc(8 * sizeof(struct radeon_ps));/* victim reuses chunk */ printf(" victim = %p == freed dpm.ps = %p: %s\n", (void *)vic, (void *)dangling, (void *)vic == (void *)dangling ? "REUSED" : "?"); memset(vic, 0x5A, 8 * sizeof(struct radeon_ps)); free(dangling); /* ni_dpm_fini:4273 */ void *again = malloc(8 * sizeof(struct radeon_ps)); printf(" after kfree(victim): next malloc returns %p == victim: %s\n" " -> victim freed while live; next allocation overlays it\n", (void *)again, (void *)again == (void *)vic ? "YES (double-alloc)" : "no"); /* NB: no cleanup frees here — vic and again alias the same chunk */ /* * [D] fixed path. */ printf("\n[D] Fixed path (fix.diff: free ps_privs, NULL the pointer,\n" " propagate rc; radeon_pm checks dpm.init rc)\n"); dpm.boot_ps = dpm.current_ps = dpm.requested_ps = NULL; dpm.ps = NULL; dpm.num_ps = 0; fail_alloc_at = 5; allocs = 0; /* replica of fixed ni_parse_power_table error path */ struct radeon_ps *psx = calloc(8, sizeof(struct radeon_ps)); struct ni_ps *privs[8]; int i, n = 0; for (i = 0; i < 8; i++) { struct ni_ps *pni = kzalloc_rep(sizeof(struct ni_ps)); if (!pni) { while (n > 0) free(privs[--n]); /* no leak */ free(psx); psx = NULL; /* no dangling */ break; } privs[n++] = pni; psx[i].ps_priv = pni; } if (psx == NULL) printf(" rc=-ENOMEM propagated; dpm.ps = NULL; ps_privs freed;\n" " radeon_pm_init_dpm aborts before touching boot_ps;\n" " ni_dpm_fini kfree(NULL) — no double free, no leak\n"); else for (i = 0; i < 8; i++) free(privs[i]), free(psx[i].ps_priv); return 0; }