/* * DF-4560 harness — proof of the fixed-offset event-member reads that run * without any validation that EventDataLength covers the structure, in * sys/dev/raid/mps/mps_sas_lsi.c mpssas_fw_work(). * * Allocation replicated verbatim from mpssas_evt_handler * (mps_sas_lsi.c:140-148): * u16 sz = le16toh(event->EventDataLength) * 4; (u16 truncation = DF-1696) * fw_event->event_data = kmalloc(sz, ...); * bcopy(event->EventData, fw_event->event_data, sz); * For each EventDataLength EDL the accessible buffer is exactly EDL*4 bytes. * * Sinks replicated (offsets from the MPI2 headers): * IR CONFIG CHANGE LIST (struct at mpi2_ioc.h:699-710, element :672-680): * event_data->Flags u32 @ 0x04 (mps_sas_lsi.c:273) * element->VolDevHandle u16 @ 0x0A (mps_sas_lsi.c:276-279 — * read happens BEFORE the NumElements loop and regardless of * NumElements, so DF-1697's loop fix does not cover it) * LOG ENTRY ADDED (struct at mpi2_ioc.h:516-528): * logEntry->LogEntryQualifier u16 @ 0x0E (mps_sas_lsi.c:515) * logEntry->LogData[0] u8 @ 0x14 (mps_sas_lsi.c:518) * * Each case is fork()ed with the kmalloc'd buffer placed so its END abuts a * PROT_NONE guard page: an OOB member read faults (SIGSEGV) exactly as the * kernel would take a page fault / slab-boundary violation. * * Also prints (no deref, pure arithmetic): * - the EDL table: allocation size vs. bytes each sink needs; * - the DF-4561 (ir_shutdown off-by-one) IR-range coverage count: * end_idx = start_idx + max_volumes - 1 (mps_sas_lsi.c:902) * for (id = start_idx; id < end_idx; id++) (:904) * -> visits max_volumes-1 slots, never id == end_idx: the LAST volume * slot is skipped when looking for volumes to notify at shutdown. * * Build: cc -O2 -o df4560 df4560_harness.c */ #include #include #include #include #include #include #include /* struct member offsets (u8-accurate from the MPI2 headers) */ #define IR_FLAGS_OFF 0x04 /* u32 */ #define IR_VOLDEVHANDLE_OFF 0x0A /* u16, ConfigElement[0]+2 */ #define LOG_QUAL_OFF 0x0E /* u16 */ #define LOG_DATA0_OFF 0x14 /* u8 */ static char * guarded_buf(size_t sz) { size_t ps = 4096; size_t pages = (sz + ps - 1) / ps + 1; char *m = mmap(NULL, (pages + 1) * ps, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0); if (m == MAP_FAILED) { perror("mmap"); exit(2); } if (mprotect(m + pages * ps, ps, PROT_NONE) != 0) { perror("mprotect"); exit(2); } return m + pages * ps - sz; /* buffer end == guard start */ } static int cases_run, cases_oob; static void case_ir(int edl_words) { /* mpssas_fw_work IR CONFIG CHANGE LIST, before/inside the loop */ char *event_data = guarded_buf((size_t)edl_words * 4); volatile uint32_t flags; volatile uint16_t volh; flags = *(volatile uint32_t *)(event_data + IR_FLAGS_OFF); /* :273 */ /* :276-279 — unconditional, happens even when NumElements == 0 */ volh = *(volatile uint16_t *)(event_data + IR_VOLDEVHANDLE_OFF); (void)flags; (void)volh; printf(" EDL=%d (%d B): read completed in-bounds\n", edl_words, edl_words * 4); } static void case_log(int edl_words) { /* mpssas_fw_work LOG ENTRY ADDED, WarpDrive branch (qualifier 0x8002) */ char *event_data = guarded_buf((size_t)edl_words * 4); volatile uint16_t qual; volatile uint8_t code; if (edl_words >= 4) *(uint16_t *)(event_data + LOG_QUAL_OFF) = 0x8002; /* MPI2_WD_LOG_ENTRY (mpsvar.h:111) — put the qualifier on-path whenever writing it is itself in bounds */ qual = *(volatile uint16_t *)(event_data + LOG_QUAL_OFF); /* :515 */ if (qual == 0x8002) code = *(volatile uint8_t *)(event_data + LOG_DATA0_OFF); /* :518 */ (void)code; printf(" EDL=%d (%d B): read completed in-bounds\n", edl_words, edl_words * 4); } static int run(int (*should_fault)(int), void (*fn)(int), const char *tag, int edl) { pid_t p = fork(); if (p == 0) { fn(edl); _exit(0); } int st; waitpid(p, &st, 0); cases_run++; if (WIFSIGNALED(st)) { cases_oob += should_fault(edl) ? 1 : 0; printf(" [%s EDL=%d] SIGSEGV — %s\n", tag, edl, should_fault(edl) ? "OOB read past the EventDataLength-sized allocation (expected)" : "UNEXPECTED fault"); return 1; } printf(" [%s EDL=%d] clean — %s\n", tag, edl, should_fault(edl) ? "UNEXPECTED: sink read OOB without fault" : "in bounds (expected)"); return 0; } static int ir_needs(int edl) { return edl * 4 < 12; } /* VolDevHandle needs 12 */ static int log_needs(int edl) { return edl * 4 < 21; } /* LogData[0] needs 21 */ int main(void) { printf("== DF-4560: unvalidated fixed-offset event-member reads " "(mps_sas_lsi.c:273,276-279,515,518) ==\n\n"); printf("allocation: sz = EventDataLength*4 bytes (mps_sas_lsi.c:140-141)\n"); printf("IR sink needs >= 12 B (Flags@4..8 + VolDevHandle@10..12)\n"); printf("LOG sink needs >= 21 B (Qualifier@14..16 + LogData[0]@20..21)\n\n"); printf("-- IR CONFIG CHANGE LIST: element->VolDevHandle read at +0x0A --\n"); run(ir_needs, case_ir, "IR ", 2); /* 8 B alloc, read @10 — OOB */ run(ir_needs, case_ir, "IR ", 3); /* 12 B alloc — exact fit, control */ printf("-- LOG ENTRY ADDED: LogData[0] read at +0x14 --\n"); run(log_needs, case_log, "LOG", 1); /* 4 B — qualifier itself OOB */ run(log_needs, case_log, "LOG", 4); /* 16 B — qualifier ok, LogData OOB */ run(log_needs, case_log, "LOG", 6); /* 24 B — fits, control */ printf("\n-- arithmetic table (no deref) --\n"); for (int edl = 0; edl <= 6; edl++) { printf(" EDL=%d: alloc=%2d B | IR VolDevHandle@10 %s | " "LOG Qualifier@14 %s | LOG LogData@20 %s\n", edl, edl * 4, edl * 4 < 12 ? "OOB" : "ok ", edl * 4 < 16 ? "OOB" : "ok ", edl * 4 < 21 ? "OOB" : "ok "); } printf("\n-- DF-4561 arithmetic: mpssas_ir_shutdown volume scan coverage " "(mps_sas_lsi.c:902-911) --\n"); unsigned max_volumes = 8, start_idx = 256, end_idx; unsigned visited = 0, last_visited; end_idx = start_idx + max_volumes - 1; for (unsigned id = start_idx; id < end_idx; id++) { visited++; last_visited = id; } printf(" IR range [%u..%u] (%u slots); loop visits %u, last visited " "%u -> slot %u (the LAST volume slot) NEVER checked for a volume " "before deciding whether to send SYSTEM_SHUTDOWN_INITIATED\n", start_idx, end_idx, max_volumes, visited, last_visited, end_idx); printf("== %d cases, %d confirmed OOB ==\n", cases_run, cases_oob); return 0; }