⬢ DragonFlyBSD Kernel Audit
DF-4387 / trigger.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
/*
 * DF-4387 trigger replica: device-controlled port_id indexes rxf.port[].
 *
 *   oce_mbox.c:493    sc->port_id = fwcmd->params.rsp.port_id;  // raw u32
 *   oce_sysctl.c:1151 port_stats = &...stats.rxf.port[port];    // port[2]
 *   oce_sysctl.c:1216 port_stats = &...stats.rxf.port[port];    // port[4]
 *   ... 66 field copies from port_stats into sc->oce_stats_info,
 *   exposed world-readable under hw.oceN.stats.* — no range check.
 *
 * Build: cc -O2 -o trigger trigger.c
 */
#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <stddef.h>

struct port_rxf {           /* ~66 dwords copied per stats refresh */
	uint32_t dword[66];
};

struct rxf_v1 {             /* oce_rxf_stats_v1: port[4] then tail */
	struct port_rxf port[4];
	uint32_t tail[40];
};

int main(void)
{
	struct rxf_v1 rxf;
	memset(&rxf, 0xAA, sizeof(rxf));          /* adjacent-heap stand-in */

	for (uint32_t port_id = 0; port_id < 6; port_id++) {
		struct port_rxf *port_stats = &rxf.port[port_id];
		ptrdiff_t off = (uint8_t *)port_stats - (uint8_t *)&rxf;
		int past_array = off >= (ptrdiff_t)sizeof(rxf.port);
		int past_struct = off + sizeof(*port_stats) > (ptrdiff_t)sizeof(rxf);
		printf("port_id=%u: read at rxf+%4zd  %s%s\n", port_id, off,
		       past_array ? "[PAST port[] ARRAY] " : "",
		       past_struct ? "[PAST mbx_get_nic_stats DMA BUFFER]"
		                   : "");
	}
	printf("v1 port[] array = %zu bytes, struct rxf = %zu bytes;\n",
	       sizeof(rxf.port), sizeof(rxf));
	printf("kernel: values land in world-readable hw.oceN.stats.* sysctls\n");
	return 0;
}