⬢ DragonFlyBSD Kernel Audit
DF-4311 / uaftrig.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
/*
 * uaftrig.ko - PoC stand-in for drm.ko's LIVE vga_switcheroo call-in sites
 * (sys/dev/drm/drm_edid.c:1770 drm_get_edid_switcheroo ->
 *  vga_switcheroo_lock_ddc()/vga_switcheroo_unlock_ddc(),
 *  sys/dev/drm/i915/i915_drv.c:742 vga_switcheroo_force_migd()).
 *
 * Writing /dev/uaftrig invokes vga_switcheroo_lock_ddc()/_unlock_ddc()
 * exactly as the DRM EDID probe path does.  The module resolves those
 * symbols at load time from the loaded vga_switcheroo.ko (same as drm.ko
 * would).  After `kldunload vga_switcheroo`, the same call goes through
 * a dangling relocated reference into freed module memory.
 */
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/bio.h>
#include <sys/bus.h>
#include <sys/malloc.h>
#include <sys/module.h>
#include <sys/proc.h>
#include <sys/types.h>
#include <sys/sysctl.h>
#include <sys/systm.h>
#include <sys/device.h>
#include <sys/conf.h>
#include <sys/rman.h>
#include <sys/uio.h>
#include <sys/errno.h>

#include <linux/pci.h>

int	vga_switcheroo_lock_ddc(struct pci_dev *pdev);
int	vga_switcheroo_unlock_ddc(struct pci_dev *pdev);

static d_open_t		uaftrig_open;
static d_close_t	uaftrig_close;
static d_write_t	uaftrig_write;

static struct dev_ops uaftrig_ops = {
	{ "uaftrig", 0, 0 },
	.d_open		= uaftrig_open,
	.d_close	= uaftrig_close,
	.d_write	= uaftrig_write,
};

static cdev_t uaftrig_dev;

static int
uaftrig_open(struct dev_open_args *ap __unused)
{
	return (0);
}

static int
uaftrig_close(struct dev_close_args *ap __unused)
{
	return (0);
}

static int
uaftrig_write(struct dev_write_args *ap __unused)
{
	int r1, r2;

	r1 = vga_switcheroo_lock_ddc(NULL);
	kprintf("uaftrig: vga_switcheroo_lock_ddc(NULL) = %d\n", r1);
	r2 = vga_switcheroo_unlock_ddc(NULL);
	kprintf("uaftrig: vga_switcheroo_unlock_ddc(NULL) = %d\n", r2);

	return (0);
}

static int
uaftrig_modhandler(struct module *m __unused, int what, void *arg __unused)
{
	switch (what) {
	case MOD_LOAD:
		uaftrig_dev = make_dev(&uaftrig_ops, 0, UID_ROOT, GID_WHEEL,
				       0600, "uaftrig");
		kprintf("uaftrig: loaded /dev/uaftrig (stand-in for drm.ko's "
			"vga_switcheroo references)\n");
		break;
	case MOD_UNLOAD:
		if (uaftrig_dev != NULL)
			destroy_dev(uaftrig_dev);
		break;
	case MOD_SHUTDOWN:
		break;
	default:
		return (EOPNOTSUPP);
	}
	return (0);
}

DEV_MODULE(uaftrig, uaftrig_modhandler, NULL);

/* Models the MODULE_DEPEND(drm/i915/amdgpu, vga_switcheroo, ...) fix */
MODULE_DEPEND(uaftrig, vga_switcheroo, 1, 1, 1);