/* * DF-5302 / DF-5303 verification harness. * * DF-5302 — NULL-pointer WRITE (kernel panic) in fwohci_db_init() * sys/bus/firewire/fwohci.c:1253 * reached from fwohci_irx_enable() fwohci.c:1606-1608 (RX) and * fwohci_itxbuf_enable() fwohci.c:1485-1487 (TX) with * dbch->ndb = xferq->bnpacket * xferq->bnchunk == 0. * * Production trigger chain (statically verified, path:line): * open("/dev/fw0.0") fwdev.c:157 * ioctl(FW_SSTBUF, {rx.nchunk=8, rx.npacket=0, rx.psize=512}) * fwdev.c:504-506 bcopy(ibufreq, &d->bufreq) -- NO validation * ioctl(FW_SRSTREAM) fwdev.c:475 * fwdev_allocbuf fwdev.c:95 * fwdma_malloc_multiseg(n = 8*0 = 0) fwdev.c:108-109 * returns a VALID am with nseg == 0 fwdma.c:160 (howmany(0,k)==0) * flag |= FWXFERQ_EXTBUF fwdev.c:134 * fc->irx_enable == fwohci_irx_enable fwohci.c:728 * dbch->ndb = 0 * 8 == 0 fwohci.c:1606 * dbch->ndesc = 2 fwohci.c:1607 * fwohci_db_init(sc, dbch) fwohci.c:1608 * for (idb = 0; idb < 0; ...) fwohci.c:1229 (skipped) * STAILQ_LAST(&dbch->db_trq, ...)->link.stqe_next = ... * fwohci.c:1253 * db_trq is EMPTY -> STAILQ_LAST == NULL (sys/sys/queue.h) * -> write at NULL + offsetof(fwohcidb_tr, link) == 0x0 * * TX twin: FW_STSTREAM (fwdev.c:447) + first fw_write() -> * fwohci_itxbuf_enable (fwohci.c:1471) -> same db_init at :1487. * * DF-5303 — DUMPDMA ioctl channel-bound off-by-one: * fwohci.c:372 `if (*dmach <= OHCI_MAX_DMA_CH)` allows ch == 0x44 * (OHCI_MAX_DMA_CH == 0x4+0x20+0x20 == 0x44, fwohcireg.h:88), but the * valid IR channel indices are 0..0x43: * dump_db(sc, 0x44): dbch = &sc->ir[0x44-0x24] = &sc->ir[0x20] * ONE PAST ir[OHCI_DMA_IRCH] (fwohcivar.h:64) -- * past the END of fwohci_softc -> adjacent heap * read (ndb/top), then a wild STAILQ walk * (fwohci.c:2271-2303 derefs unvalidated * garbage pointers). * dump_dma(sc, 0x44): OHCI_IRCTL(0x20) = 0x800 -- MMIO read past * the 2 KB OHCI register file. * * The harness compiles the PRODUCTION sys/bus/firewire/fwohci.c into the * module (via #include) so the static production functions run unchanged. * The only synthetic state is the bus_space (bst = MEM tag, bsh = a plain * kernel-memory block: on x86_64 bus_space_read_4/write_4 with the MEM * tag are direct memory accesses, sys/cpu/x86_64/include/bus_dma.h:139-162) * and the FireWire bus state itself -- no FireWire controller exists on * the QEMU guest (hardware-gated finding). * * fwohci.c's global symbols are renamed via -D in the Makefile so they do * not collide with the copy already compiled into the guest kernel * (X86_64_GENERIC has `device firewire`). */ #include #include #include #include #include #include #include /* PRODUCTION source: statics (fwohci_db_init, fwohci_irx_enable, dump_db) * become callable in this translation unit. */ #include static int df5302_mode = 1; /* 1 = DF-5302, 2 = DF-5303 */ static int df5302_trigger = 0; SYSCTL_INT(_kern, OID_AUTO, df5302_mode, CTLFLAG_RW, &df5302_mode, 0, "harness case: 1=DF-5302 db_init ndb=0, 2=DF-5303 dump_db ch 0x44"); SYSCTL_INT(_kern, OID_AUTO, df5302_trigger, CTLFLAG_RW, &df5302_trigger, 0, "write 1 to fire the harness case (expect a kernel panic)"); /* * DF-5302: drive the PRODUCTION fwohci_irx_enable() with exactly the * xferq state fwdev_allocbuf() leaves after FW_SSTBUF{npacket=0}. */ static void df5302_run_irx_enable(void) { struct fwohci_softc *sc; struct fw_xferq *ir; char *regs; int error; sc = kmalloc(sizeof(*sc), M_FW, M_WAITOK | M_ZERO); regs = kmalloc(0x1000, M_FW, M_WAITOK | M_ZERO); /* fake MMIO window (plain kernel memory on x86_64 non-IO tags) */ sc->bst = X86_64_BUS_SPACE_MEM; sc->bsh = (bus_space_handle_t)regs; /* state exactly as fwdev_allocbuf() + FW_SSTBUF produced it */ sc->fc.nisodma = 8; /* probed channels */ ir = &sc->ir[0].xferq; ir->flag = FWXFERQ_STREAM | FWXFERQ_EXTBUF; /* fwdev.c:133-134 */ ir->bnchunk = 8; /* FW_SSTBUF rx.nchunk */ ir->bnpacket = 0; /* FW_SSTBUF rx.npacket */ ir->psize = 512; /* FW_SSTBUF rx.psize */ ir->dmach = 0; kprintf("DF5302: sizeof(fwohci_softc)=%zu sizeof(fwohcidb_tr)=%zu " "offsetof(fwohcidb_tr,link)=%zu\n", sizeof(*sc), sizeof(struct fwohcidb_tr), offsetof(struct fwohcidb_tr, link)); kprintf("DF5302: calling production fwohci_irx_enable() with " "bnpacket*bnchunk = %u*%u = 0 -- expect NULL write panic at " "fwohci.c:1253\n", ir->bnpacket, ir->bnchunk); error = fwohci_irx_enable(&sc->fc, 0); /* production fwohci.c:1586 */ kprintf("DF5302: SURVIVED fwohci_irx_enable, returned %d " "(baseline expects panic; fixed kernel expects EINVAL)\n", error); } /* * DF-5303: drive the PRODUCTION dump_db() with ch == OHCI_MAX_DMA_CH, * the off-by-one value the DUMPDMA ioctl accepts (fwohci.c:372). */ static void df5303_run_dump_db(void) { struct fwohci_softc *sc; struct fwohci_dbch *oob; char *regs; /* * ir[OHCI_DMA_IRCH] is one past the ir[] array. ir[] is NOT the * last member of fwohci_softc (fwohcivar.h:64-70): the phantom * fwohci_dbch at &sc->ir[32] TYPE-CONFUSES the softc tail: * phantom->ndb == sc->maxrec (nonzero after reset: * speed+8, fwohci.c:521) * phantom->db_trq.stqh_first == sc->sid_buf (and stqh_last == * sc->sid_dma.dma_tag) * phantom->top == sc->sid_dma.dma_map (fwdma.h:40 -- a REAL * kernel heap pointer once fwohci_init() * loaded the SID buffer map, so on hardware * the walk always follows bus_dmamap_impl * internals as a descriptor ring and * print_db() leaks them to the console) * so on real hardware dump_db() ALWAYS walks (ndb != 0) and follows * sid_dma/sid_buf fields as an fwohcidb_tr ring. We emulate the * post-reset state and make the first hop (STAILQ_NEXT of the * "top") fault at 0x10. */ sc = kmalloc(sizeof(*sc), M_FW, M_WAITOK | M_ZERO); regs = kmalloc(0x1000, M_FW, M_WAITOK | M_ZERO); sc->bst = X86_64_BUS_SPACE_MEM; sc->bsh = (bus_space_handle_t)regs; sc->maxrec = 10; /* sc->fc.speed+8, fwohci.c:521 */ sc->sid_dma.dma_map = (bus_dmamap_t)0x10; /* phantom dbch->top */ oob = (struct fwohci_dbch *)&sc->ir[OHCI_DMA_IRCH]; kprintf("DF5303: sc=%p sizeof=%zu &sc->ir[0x20]=%p is %zd bytes " "past ir[0] (%zu into the %zu-byte softc tail alias)\n", sc, sizeof(*sc), &sc->ir[OHCI_DMA_IRCH], (char *)&sc->ir[OHCI_DMA_IRCH] - (char *)&sc->ir[0], (char *)&sc->ir[OHCI_DMA_IRCH] - (char *)&sc->maxrec + 1, sizeof(*sc)); kprintf("DF5303: phantom dbch->ndb(=maxrec)=%u phantom->top" "(=sid_dma.dma_map)=%p\n", oob->ndb, oob->top); kprintf("DF5303: calling production dump_db(sc, OHCI_MAX_DMA_CH=0x44)" " -- expect fault at 0x10 inside the STAILQ walk\n"); dump_db(sc, OHCI_MAX_DMA_CH); /* production fwohci.c:2236 */ kprintf("DF5303: SURVIVED dump_db (unexpected)\n"); } static int df5302_sysctl_trigger(SYSCTL_HANDLER_ARGS) { int error, t = df5302_trigger; error = sysctl_handle_int(oidp, &t, 0, req); if (error != 0 || req->newptr == NULL) return (error); df5302_trigger = t; if (t) { if (df5302_mode == 2) df5303_run_dump_db(); else df5302_run_irx_enable(); } return (0); } SYSCTL_PROC(_kern, OID_AUTO, df5302_fire, CTLTYPE_INT | CTLFLAG_RW, 0, 0, df5302_sysctl_trigger, "I", "fire the DF-5302/5303 case"); static int df5302_modevent(module_t mod, int type, void *data) { switch (type) { case MOD_LOAD: kprintf("DF5302: harness loaded (production fwohci.c " "compiled in); kern.df5302_mode=%d " "kern.df5302_fire=1 to trigger\n", df5302_mode); return (0); case MOD_UNLOAD: return (0); default: return (ENOTSUP); } } static moduledata_t df5302_mod = { "df5302", df5302_modevent, NULL }; DECLARE_MODULE(df5302, df5302_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE);