/* * mtwprobe.c - structural proof for DF-5258: * DragonFly sys/bus/u4b/wlan/if_mtwvar.h declares * struct mtw_endpoint_queue sc_epq[MTW_BULK_RX]; * where MTW_BULK_RX is the FIRST constant of the xfer enum == 0. * GCC treats this as a zero-length array: sizeof(struct mtw_softc) * therefore does NOT include the 6 endpoint queues, yet * mtw_init_locked() (if_mtw.c:4466-4467) calls mtw_setup_tx_list() * on sc->sc_epq[0..5] on every interface UP, stamping * 6 * sizeof(struct mtw_endpoint_queue) bytes starting at the * sc_epq offset - far past the end of the softc allocation. * * This module compiles the REAL if_mtwvar.h from the guest kernel * source, prints the real sizes/offsets, then re-runs the exact * mtw_setup_tx_list() stamping loop (copied verbatim from * if_mtw.c:949-965) against a kmalloc'd buffer the size of the * softc followed by a 0xAA guard region, and counts how many guard * bytes get clobbered - i.e. how far past the softc allocation the * writes land. No MT7601U hardware is needed for this proof. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "opt_wlan.h" #include "if_mtwreg.h" #include "if_mtwvar.h" /* the real thing: /usr/src/sys/bus/u4b/wlan/if_mtwvar.h */ /* verbatim copy of mtw_setup_tx_list() - sys/bus/u4b/wlan/if_mtw.c:949-965 */ static void mtw_setup_tx_list(struct mtw_softc *sc, struct mtw_endpoint_queue *pq) { struct mtw_tx_data *data; memset(pq, 0, sizeof(*pq)); STAILQ_INIT(&pq->tx_qh); STAILQ_INIT(&pq->tx_fh); for (data = &pq->tx_data[0]; data < &pq->tx_data[MTW_TX_RING_COUNT]; data++) { data->sc = sc; STAILQ_INSERT_TAIL(&pq->tx_fh, data, next); } pq->tx_nfree = MTW_TX_RING_COUNT; } #define GUARD (256 * 1024) static void report(void) { size_t scsz = sizeof(struct mtw_softc); size_t pqsz = sizeof(struct mtw_endpoint_queue); size_t epq_off = __offsetof(struct mtw_softc, sc_epq); uint8_t *buf; struct mtw_softc *sc; size_t i, clobber = 0, firstbad = 0; int q; kprintf("mtwprobe: MTW_BULK_RX=%d MTW_EP_QUEUES=%d MTW_TX_RING_COUNT=%d\n", MTW_BULK_RX, MTW_EP_QUEUES, MTW_TX_RING_COUNT); kprintf("mtwprobe: sizeof(struct mtw_softc) = %zu\n", scsz); kprintf("mtwprobe: sizeof(struct mtw_endpoint_queue) = %zu\n", pqsz); kprintf("mtwprobe: sizeof(sc->sc_epq) as declared = %zu <-- zero-length array!\n", sizeof(((struct mtw_softc *)0)->sc_epq)); kprintf("mtwprobe: offsetof(struct mtw_softc, sc_epq) = %zu\n", epq_off); kprintf("mtwprobe: offsetof(rfswitch) [next member] = %zu (== sc_epq base)\n", __offsetof(struct mtw_softc, rfswitch)); kprintf("mtwprobe: 6 queues need %zu bytes from offset %zu -> end %zu; softc is only %zu bytes -> %zd bytes PAST the allocation\n", pqsz * MTW_EP_QUEUES, epq_off, epq_off + pqsz * MTW_EP_QUEUES, scsz, (ssize_t)(epq_off + pqsz * MTW_EP_QUEUES - scsz)); buf = kmalloc(scsz + GUARD, M_TEMP, M_WAITOK | M_ZERO); memset(buf + scsz, 0xAA, GUARD); sc = (struct mtw_softc *)buf; /* exactly what mtw_init_locked() does at if_mtw.c:4466-4467 */ for (q = 0; q != MTW_EP_QUEUES; q++) mtw_setup_tx_list(sc, &sc->sc_epq[q]); for (i = 0; i < GUARD; i++) { if (buf[scsz + i] != 0xAA) { if (clobber == 0) firstbad = i; clobber++; } } kprintf("mtwprobe: simulated ifconfig-up stamping clobbered %zu bytes past sizeof(struct mtw_softc) (first at +%zu)\n", clobber, firstbad); /* ---- alias mapping: which live softc fields fall inside the epq region? ---- */ struct { const char *n; size_t o; } fields[] = { {"rfswitch", __offsetof(struct mtw_softc, rfswitch)}, {"txpow1", __offsetof(struct mtw_softc, txpow1)}, {"lna", __offsetof(struct mtw_softc, lna)}, {"txpow20mhz", __offsetof(struct mtw_softc, txpow20mhz)}, {"sc_chan_group", __offsetof(struct mtw_softc, sc_chan_group)}, {"cmd_seq", __offsetof(struct mtw_softc, cmd_seq)}, {"sc_detached", __offsetof(struct mtw_softc, sc_detached)}, {"sc_mcu", __offsetof(struct mtw_softc, sc_mcu)}, {"rxq", __offsetof(struct mtw_softc, rxq)}, {"txq", __offsetof(struct mtw_softc, txq)}, {"ratectl_task", __offsetof(struct mtw_softc, ratectl_task)}, {"ratectl_ch", __offsetof(struct mtw_softc, ratectl_ch)}, {"sc_bssid", __offsetof(struct mtw_softc, sc_bssid)}, {"sc_rxtapu", __offsetof(struct mtw_softc, sc_rxtapu)}, {"sc_txtapu", __offsetof(struct mtw_softc, sc_txtapu)}, }; size_t epq_end = epq_off + pqsz * MTW_EP_QUEUES; for (i = 0; i < sizeof(fields)/sizeof(fields[0]); i++) { const char *where; if (fields[i].o < epq_off) where = "BEFORE epq region"; else if (fields[i].o < epq_end) { size_t rel = fields[i].o - epq_off; size_t q = rel / pqsz; size_t in = rel % pqsz; size_t ent = in / sizeof(struct mtw_tx_data); size_t off = in % sizeof(struct mtw_tx_data); kprintf("mtwprobe: LIVE FIELD %-14s @+%6zu INSIDE epq[%zu] tx_data[%zu] + %zu (%s)\n", fields[i].n, fields[i].o, q, ent, off, off < 16 ? "STAILQ next ptr" : off < 24 ? "m (mbuf*)" : off < 32 ? "sc ptr" : off < 40 ? "xfer ptr" : off < 44 ? "qid/ridx" : off < 48 ? "buflen" : off < 56 ? "ni (node*) !" : "desc[]"); continue; } else where = "after epq region (safe)"; kprintf("mtwprobe: live field %-14s @+%6zu %s\n", fields[i].n, fields[i].o, where); } kfree(buf, M_TEMP); /* ---- forge simulation with RAW byte addresses (no member access) ---- */ { uint8_t *p = (uint8_t *)sc; void **ni_p = (void **)(p + __offsetof(struct mtw_softc, sc_epq) + 3 * sizeof(struct mtw_tx_data) + 48); /* epq[0].tx_data[3].ni */ kprintf("mtwprobe: raw check: &sc_chan_group=%p epq[0].tx_data[3].ni at %p (same? %d)\n", (void *)(p + __offsetof(struct mtw_softc, sc_chan_group)), (void *)ni_p, (size_t)ni_p + 4 == (size_t)(p + __offsetof(struct mtw_softc, sc_chan_group))); /* idle case: post-stamp ni == NULL; mtw_set_chan() writes group */ kprintf("mtwprobe: idle: ni before = %p\n", *ni_p); sc->sc_chan_group = 2; /* mtw_set_chan(), if_mtw.c:3758 */ kprintf("mtwprobe: idle: ni after sc_chan_group=2 -> %p <-- forged node ptr\n", *ni_p); /* in-flight case: entry holds a real node pointer */ *ni_p = (void *)0xfffff800deadbeefULL; sc->sc_chan_group = 3; kprintf("mtwprobe: in-flight: ni was 0xfffff800deadbeef, after sc_chan_group=3 -> %p\n", *ni_p); kprintf("mtwprobe: this pointer is passed to ieee80211_tx_complete()/ieee80211_free_node() on TX completion.\n"); } kfree(buf, M_TEMP); } static int mtwprobe_modevent(module_t mod, int type, void *data) { switch (type) { case MOD_LOAD: report(); break; default: break; } return (0); } static moduledata_t mtwprobe_mod = { "mtwprobe", mtwprobe_modevent, NULL }; DECLARE_MODULE(mtwprobe, mtwprobe_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE);