/* * DF-3998 / DF-3999 — verbatim-code logic harness for the envy24ht(4) * DMA-emulator out-of-bounds indices (sys/dev/sound/pci/envy24ht.c). * * The five emldma functions below are copied VERBATIM (only #if(0) debug * blocks omitted) from: * * envy24ht_p32sl sys/dev/sound/pci/envy24ht.c:1311-1339 * envy24ht_p16sl sys/dev/sound/pci/envy24ht.c:1341-1384 * envy24ht_p8u sys/dev/sound/pci/envy24ht.c:1386-1414 * envy24ht_r32sl sys/dev/sound/pci/envy24ht.c:1416-1444 * envy24ht_r16sl sys/dev/sound/pci/envy24ht.c:1446-1474 * offset math envy24htchan_trigger else-branch, envy24ht.c:1721-1723 * hwptr math envy24ht_gethwptr, envy24ht.c:1124-1152 * channel map envy24ht_chanmap[], envy24ht.c:221-233 * registration envy24ht_pci_attach, envy24ht.c:2494-2505 * (1 play channel + (2+adcn) rec channels; adcn = * ((scfg & 0x0c)>>2)+1; standard board scfg=0x0b -> * adcn=3 -> 5 rec channels, hw nums {1,2,3,4,10} -> * slot=(num-5)*2 = {-8,-6,-4,-2,+10}) * * Environment model (matches envy24ht.c + the pcm core): * - pbuf = ENVY24HT_PLAY_BUFUNIT(32) * ENVY24HT_SAMPLE_NUM(4096) * = 131072 bytes = 32768 sample32_t entries (envy24ht.c:2160) * - rbuf = ENVY24HT_REC_BUFUNIT(8) * 4096 = 32768 bytes * = 8192 sample32_t entries (envy24ht.c:2161) * - ch->size = unit * ENVY24HT_SAMPLE_NUM (envy24ht.c:1584) * - readyptr/freeptr in [0, ch->size) — controlled by how many bytes the * unprivileged user wrote/read on the channel before triggering * - ptr = envy24ht_gethwptr() frame index in [0,4095] of the RUNNING * first same-direction channel — user-observable via * SNDCTL_DSP_GETOPTR/GETIPTR on that channel * - ch->blk = as produced by envy24htchan_setblocksize * (envy24ht.c:1648-1659) for a user-chosen blocksize: * rec S16: blk = prev/4*2 = prev/2 (prev = power of 2 <= size/2) * play S16: blk = prev/4*8 = prev*2 * * Cases (soft mode; canary arenas sized around the exact kernel buffers): * [A] DF-3999: FIRST record channel (hw num 1 -> slot -8), offset 0: * EMLDMARD reads sample32_t entries at indices -8..-1 (32 bytes * BEFORE rbuf) into the user record stream. * [B] DF-3999: 5th record channel (hw num 10 -> slot +10), offset 0: * reads up to 10 entries PAST the rbuf end, unconditionally. * [C] DF-3998: SECOND record channel START (S16_LE, attacker-chosen * ptr/blk -> offset 4088): first loop access reads ~32 KB past rbuf * into the user record stream (kernel heap disclosure). * [D] DF-3998 play twin (p16sl): same unclamped dst=src/2+offset writes * attacker PCM up to ~130 KB past pbuf — write primitive exists but * needs 2 running PLAY channels; the driver registers exactly 1 * (envy24ht.c:2494-2499) so on the driver as shipped this is LATENT * (goes live if the commented-out 5-play-channel loop is restored). * * hard mode: rbuf against a PROT_NONE guard page sized exactly like the * kernel bus_dmamem allocation -> case [C] faults, proving the index * arithmetic the kernel would run against real kernel memory. * * Kernel-heap stand-in markers (chosen so the leaked value survives the * 16-bit truncation of r16sl): * before rbuf: 0xABADBE00 | (i & 0xff) -> 32-bit 0xABADBExx / 16-bit 0xBExx * past rbuf: 0xDEADFE00 | (i & 0xff) -> 32-bit 0xDEADFExx / 16-bit 0xFExx * past pbuf: 0xDEAD0000 | i (overwritten value 0xB9B90000) */ #include #include #include #include #include #include #include #define ENVY24HT_PLAY_CHNUM 8 #define ENVY24HT_REC_CHNUM 2 #define ENVY24HT_SAMPLE_NUM 4096 #define ENVY24HT_PLAY_BUFUNIT (4 * 8) #define ENVY24HT_REC_BUFUNIT (4 * 2) #define PCMDIR_PLAY 1 #define PCMDIR_REC 2 typedef struct { volatile uint32_t buffer; } sample32_t; struct sc_info; struct sc_chinfo { void *buffer; struct sc_info *parent; int dir; unsigned num; uint32_t format; uint32_t speed; uint32_t blk; uint8_t *data; unsigned int size; int unit; unsigned int offset; void (*emldma)(struct sc_chinfo *); int run; }; struct sc_info { sample32_t *pbuf; sample32_t *rbuf; uint32_t psize, rsize; }; static uint32_t g_readyptr, g_freeptr, g_ready, g_free; #define sndbuf_getready(b) (g_ready) #define sndbuf_getfree(b) (g_free) #define sndbuf_getreadyptr(b) (g_readyptr) #define sndbuf_getfreeptr(b) (g_freeptr) /* ================= VERBATIM FROM envy24ht.c ========================= */ static void envy24ht_p32sl(struct sc_chinfo *ch) { int length; sample32_t *dmabuf; uint32_t *data; int src, dst, ssize, dsize, slot; int i; length = sndbuf_getready(ch->buffer) / 8; dmabuf = ch->parent->pbuf; data = (uint32_t *)ch->data; src = sndbuf_getreadyptr(ch->buffer) / 4 % (ch->size / 4); src -= src % 2; dst = (src / 2 + ch->offset) % (ch->size / 8); ssize = ch->size / 4; dsize = ch->size / 8; slot = ch->num * 2; for (i = 0; i < length; i++) { dmabuf[dst * ENVY24HT_PLAY_CHNUM + slot].buffer = data[src]; dmabuf[dst * ENVY24HT_PLAY_CHNUM + slot + 1].buffer = data[src + 1]; dst++; dst %= dsize; src += 2; src %= ssize; } return; } static void envy24ht_p16sl(struct sc_chinfo *ch) { int length; sample32_t *dmabuf; uint16_t *data; int src, dst, ssize, dsize, slot; int i; length = sndbuf_getready(ch->buffer) / 4; dmabuf = ch->parent->pbuf; data = (uint16_t *)ch->data; src = sndbuf_getreadyptr(ch->buffer) / 2 % (ch->size / 2); src -= src % 2; dst = (src / 2 + ch->offset) % (ch->size / 4); ssize = ch->size / 2; dsize = ch->size / 4; slot = ch->num * 2; for (i = 0; i < length; i++) { dmabuf[dst * ENVY24HT_PLAY_CHNUM + slot].buffer = (uint32_t)data[src] << 16; dmabuf[dst * ENVY24HT_PLAY_CHNUM + slot + 1].buffer = (uint32_t)data[src + 1] << 16; dst++; dst %= dsize; src += 2; src %= ssize; } return; } static void envy24ht_p8u(struct sc_chinfo *ch) { int length; sample32_t *dmabuf; uint8_t *data; int src, dst, ssize, dsize, slot; int i; length = sndbuf_getready(ch->buffer) / 2; dmabuf = ch->parent->pbuf; data = (uint8_t *)ch->data; src = sndbuf_getreadyptr(ch->buffer) % ch->size; src -= src % 2; dst = (src / 2 + ch->offset) % (ch->size / 4); ssize = ch->size; dsize = ch->size / 4; slot = ch->num * 2; for (i = 0; i < length; i++) { dmabuf[dst * ENVY24HT_PLAY_CHNUM + slot].buffer = ((uint32_t)data[src] ^ 0x80) << 24; dmabuf[dst * ENVY24HT_PLAY_CHNUM + slot + 1].buffer = ((uint32_t)data[src + 1] ^ 0x80) << 24; dst++; dst %= dsize; src += 2; src %= ssize; } return; } static void envy24ht_r32sl(struct sc_chinfo *ch) { int length; sample32_t *dmabuf; uint32_t *data; int src, dst, ssize, dsize, slot; int i; length = sndbuf_getfree(ch->buffer) / 8; dmabuf = ch->parent->rbuf; data = (uint32_t *)ch->data; dst = sndbuf_getfreeptr(ch->buffer) / 4 % (ch->size / 4); dst -= dst % 2; src = (dst / 2 + ch->offset) % (ch->size / 8); dsize = ch->size / 4; ssize = ch->size / 8; slot = ((ch->num - 5 /* ENVY24HT_CHAN_REC_ADC1 */) * 2) % ENVY24HT_REC_CHNUM; for (i = 0; i < length; i++) { data[dst] = dmabuf[src * ENVY24HT_REC_CHNUM + slot].buffer; data[dst + 1] = dmabuf[src * ENVY24HT_REC_CHNUM + slot + 1].buffer; dst += 2; dst %= dsize; src++; src %= ssize; } return; } static void envy24ht_r16sl(struct sc_chinfo *ch) { int length; sample32_t *dmabuf; uint16_t *data; int src, dst, ssize, dsize, slot; int i; length = sndbuf_getfree(ch->buffer) / 4; dmabuf = ch->parent->rbuf; data = (uint16_t *)ch->data; dst = sndbuf_getfreeptr(ch->buffer) / 2 % (ch->size / 2); dst -= dst % 2; src = (dst / 2 + ch->offset) % (ch->size / 8); dsize = ch->size / 2; ssize = ch->size / 8; slot = ((ch->num - 5 /* ENVY24HT_CHAN_REC_ADC1 */) * 2) % ENVY24HT_REC_CHNUM; for (i = 0; i < length; i++) { data[dst] = dmabuf[src * ENVY24HT_REC_CHNUM + slot].buffer; data[dst + 1] = dmabuf[src * ENVY24HT_REC_CHNUM + slot + 1].buffer; dst += 2; dst %= dsize; src++; src %= ssize; } return; } /* envy24htchan_trigger PCMTRIG_START, second same-direction channel * (envy24ht.c:1714-1726, the sc->run[slot] != 1 branch) */ static unsigned int trigger_offset_2nd_channel(uint32_t hw_ptr /* frames */, uint32_t blk, uint32_t chsize_dwords /* ch->size/4 */, int unit) { return ((hw_ptr / blk + 1) * blk % chsize_dwords) * 4 / unit; } /* ================== harness scaffolding ============================ */ static const size_t PBUF_BYTES = ENVY24HT_PLAY_BUFUNIT * ENVY24HT_SAMPLE_NUM; static const size_t RBUF_BYTES = ENVY24HT_REC_BUFUNIT * ENVY24HT_SAMPLE_NUM; static const size_t GUARD = 0x40000; static char *arena_p, *arena_r; static sample32_t *pbuf, *rbuf; static sigjmp_buf jb; static volatile int in_test; static void segv(int sig) { if (in_test) siglongjmp(jb, 1); else _exit(9); } static void setup_soft(void) { /* pbuf and rbuf live in SEPARATE arenas, each with canary margins on * both sides — in the kernel they are separate bus_dmamem_alloc's * (envy24ht.c:2171-2187), so adjacent canaries must not alias. */ arena_p = malloc(PBUF_BYTES + 2 * GUARD); arena_r = malloc(RBUF_BYTES + 2 * GUARD); memset(arena_p, 0, PBUF_BYTES + 2 * GUARD); memset(arena_r, 0, RBUF_BYTES + 2 * GUARD); pbuf = (sample32_t *)(arena_p + GUARD); rbuf = (sample32_t *)(arena_r + GUARD); /* kernel-heap stand-ins around each buffer */ for (size_t i = 1; i <= GUARD / 4; i++) { pbuf[-(ssize_t)i].buffer = 0xABADBE00u | (i & 0xffu); rbuf[-(ssize_t)i].buffer = 0xABADBE00u | (i & 0xffu); } for (size_t i = 0; i < GUARD / 4; i++) { pbuf[PBUF_BYTES / 4 + i].buffer = 0xDEAD0000u + (uint32_t)i; rbuf[RBUF_BYTES / 4 + i].buffer = 0xDEADFE00u | (i & 0xffu); } } static struct sc_info S; static void report_rec32(const char *tag, uint32_t *data32, size_t nwords) { size_t before = 0, past = 0; uint32_t firstv = 0; size_t firsti = 0; int have = 0; for (size_t i = 0; i < nwords; i++) { uint32_t v = data32[i]; if ((v & 0xFF00FF00u) == 0xAB00BE00u || (v & 0xFF00FF00u) == 0xDE00FE00u) { if ((v & 0xFF00FF00u) == 0xAB00BE00u) before++; else past++; if (!have) { firstv = v; firsti = i; have = 1; } } } printf(" [%s] user stream received %zu samples from BEFORE rbuf, " "%zu from PAST rbuf end%s", tag, before, past, have ? "\n" : " (none)\n"); if (have) printf(" first leaked: data[%zu] = 0x%08x (kernel-heap marker)\n", firsti, firstv); } static void report_rec16(const char *tag, uint16_t *data16, size_t nwords) { size_t before = 0, past = 0; uint16_t firstv = 0; size_t firsti = 0; int have = 0; for (size_t i = 0; i < nwords; i++) { uint16_t v = data16[i]; if ((v & 0xFF00u) == 0xBE00u || (v & 0xFF00u) == 0xFE00u) { if ((v & 0xFF00u) == 0xBE00u) before++; else past++; if (!have) { firstv = v; firsti = i; have = 1; } } } printf(" [%s] user stream received %zu samples from BEFORE rbuf, " "%zu from PAST rbuf end%s", tag, before, past, have ? "\n" : " (none)\n"); if (have) printf(" first leaked: data[%zu] = 0x%04x (low half of " "kernel-heap 0xDEAD/0xABAD marker word)\n", firsti, firstv); } int main(int argc, char **argv) { int hard = (argc > 1 && strcmp(argv[1], "hard") == 0); printf("DF-3998/DF-3999 FIXED variant (mode=%s)\n", hard ? "hard" : "soft"); printf("pbuf=%zuB (%zu entries) rbuf=%zuB (%zu entries)\n", PBUF_BYTES, PBUF_BYTES / 4, RBUF_BYTES, RBUF_BYTES / 4); signal(SIGSEGV, segv); if (!hard) { setup_soft(); S.pbuf = pbuf; S.rbuf = rbuf; S.psize = PBUF_BYTES; S.rsize = RBUF_BYTES; /* [A] DF-3999 — first rec channel, hw num 1, slot -8, offset 0 */ { struct sc_chinfo ch; static uint32_t data32[8192 + 4]; memset(&ch, 0, sizeof(ch)); ch.parent = &S; ch.dir = PCMDIR_REC; ch.num = 1; ch.unit = 8; ch.size = 8 * ENVY24HT_SAMPLE_NUM; ch.data = (uint8_t *)data32; memset(data32, 0, sizeof(data32)); g_freeptr = 0; g_free = ch.size; envy24ht_r32sl(&ch); printf("[A] 1st rec ch (num=1, slot=-8, offset=0), r32sl:\n"); report_rec32("A", data32, 32 /* first 16 frames */); } /* [B] DF-3999 — 5th rec channel, hw num 10, slot +10, offset 0 */ { struct sc_chinfo ch; static uint32_t data32[8192 + 4]; memset(&ch, 0, sizeof(ch)); ch.parent = &S; ch.dir = PCMDIR_REC; ch.num = 10; ch.unit = 8; ch.size = 8 * ENVY24HT_SAMPLE_NUM; ch.data = (uint8_t *)data32; memset(data32, 0, sizeof(data32)); g_freeptr = 0; g_free = ch.size; envy24ht_r32sl(&ch); printf("[B] 5th rec ch (num=10, slot=+10, offset=0), r32sl:\n"); report_rec32("B", data32, 8192); } /* [C] DF-3998 — second rec channel START, S16_LE, worst case: * user blocksize 16 -> blk = 8 dwords; running 1st rec * channel at hw ptr 4087 frames (via GETIPTR); * offset = ((4087/8)+1)*8 % 4096 = 4088. * dst = freeptr/2 = 8191 -> the first access also writes * data16[8192], one element past the 8192-entry ch->data * (kernel M_ENVY24HT kmalloc) - same access-before-wrap * defect on the data side. */ { struct sc_chinfo ch; static uint16_t data16[16384]; uint32_t blk = 8, off; memset(&ch, 0, sizeof(ch)); ch.parent = &S; ch.dir = PCMDIR_REC; ch.num = 2; ch.unit = 4; ch.size = 4 * ENVY24HT_SAMPLE_NUM; ch.data = (uint8_t *)data16; memset(data16, 0, sizeof(data16)); off = trigger_offset_2nd_channel(4087, blk, ch.size / 4, ch.unit); ch.offset = off; printf("[C] 2nd rec ch (num=2, slot=-6) START: ptr=4087 " "blk=%u -> offset=%u (ssize=%d)\n", blk, off, ch.size / 8); g_freeptr = ch.size - 2; g_free = ch.size; envy24ht_r16sl(&ch); report_rec16("C", data16, 8192); if (data16[8192] != 0) printf(" data-side OOB write: data16[8192] = " "0x%04x (one element past ch->data)\n", data16[8192]); } /* [D] DF-3998 play twin — p16sl with offset (LATENT on this * driver as registered: needs 2 running play channels). * user blocksize 16 -> prev=16 -> blk = 16/4*8 = 32 dwords; * ptr=4063 -> offset = ((4063/32)+1)*32 % 4096 = 4064 */ { struct sc_chinfo ch; static uint16_t data16[8192]; uint32_t blk = 32, off; /* prev=16 -> 16/4*8 = 32 */ memset(&ch, 0, sizeof(ch)); ch.parent = &S; ch.dir = PCMDIR_PLAY; ch.num = 1; ch.unit = 4; ch.size = 4 * ENVY24HT_SAMPLE_NUM; ch.data = (uint8_t *)data16; for (size_t i = 0; i < 8192; i++) data16[i] = 0xB9B9; off = trigger_offset_2nd_channel(4063, blk, ch.size / 4, ch.unit); ch.offset = off; g_readyptr = ch.size - 4; g_ready = ch.size; envy24ht_p16sl(&ch); size_t oob = 0, firsti = 0; int have = 0; for (size_t i = 0; i < GUARD / 4; i++) { if (pbuf[PBUF_BYTES / 4 + i].buffer != 0xDEAD0000u + (uint32_t)i) { oob++; if (!have) { firsti = i; have = 1; } } } printf("[D] play twin p16sl (LATENT, 2nd play ch): " "offset=%u -> %zu sample32 entries written past " "pbuf end", off, oob); if (have) printf(", first at +%zu bytes (value 0x%08x)\n", firsti * 4, (unsigned)pbuf[PBUF_BYTES / 4 + firsti].buffer); else printf(" none\n"); } free(arena_p); free(arena_r); printf("SOFT-DONE\n"); return 0; } /* hard mode: guard page exactly after rbuf */ { size_t pagesz = 4096; char *m = mmap(NULL, RBUF_BYTES + pagesz, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); if (m == MAP_FAILED) { perror("mmap"); return 1; } if (mprotect(m + RBUF_BYTES, pagesz, PROT_NONE) != 0) { perror("mprotect"); return 1; } memset(m, 0, RBUF_BYTES); S.rbuf = (sample32_t *)m; S.pbuf = NULL; S.psize = PBUF_BYTES; S.rsize = RBUF_BYTES; struct sc_chinfo ch; static uint16_t data16[8192]; memset(&ch, 0, sizeof(ch)); ch.parent = &S; ch.dir = PCMDIR_REC; ch.num = 2; ch.unit = 4; ch.size = 4 * ENVY24HT_SAMPLE_NUM; ch.data = (uint8_t *)data16; ch.offset = trigger_offset_2nd_channel(4087, 8, ch.size / 4, ch.unit); g_freeptr = ch.size - 2; g_free = ch.size; in_test = 1; if (sigsetjmp(jb, 1) == 0) { envy24ht_r16sl(&ch); printf("HARD: no fault (unexpected)\n"); } else { printf("HARD: SIGSEGV at first OOB read past rbuf end " "(offset=%u) - index arithmetic proven\n", ch.offset); } in_test = 0; munmap(m, RBUF_BYTES + pagesz); } return 0; }