/* * DF-5545 harness — xhci_pci_detach() swallows device_delete_children() * failure (xhci_pci.c:355) and unconditionally tears down the controller, * IRQ, MMIO BAR and all DMA (xhci_uninit) under a child that vetoed * detach, then reports success (:380). * * Same KLD pattern as the proven DF-5544 rig (uhci), adapted for xhci: * the device_detach() is issued from a dedicated kernel thread (the * sysctl path holds gd_sysctllock across handler dispatch; the usb * teardown calls device_sysctl_fini -> sysctl_unregister_oid). * * Guest must be booted with a real xHCI controller: * QEMU_EXTRA="-device qemu-xhci" dfbsd-qemu/vm.sh up * * kldload /root/df5545/veto.ko * -> finds xhci0, attaches "veto0" child (detach returns EBUSY while * the parent xhci driver is still bound) * * sysctl hw.df5545=1 : snapshot live event/command-ring + DCBAA DMA * pages, then device_detach(xhci0) — exactly what * devclass_delete_driver() (subr_bus.c:897, i.e. kldunload / PCI * hot-unplug) does. * EXPECTED (bug): returns 0, "xhci0: detached", IRQ/MMIO released, * xhci_uninit frees ring/DCBAA/scratchpad DMA, while veto0 is * STILL ATTACHED to xhci0. * sysctl hw.df5545=2 : touch the parent context through the orphan — * device_get_softc() now returns NULL (device_set_driver(dev,NULL) * kfree'd the softc) -> Fatal trap 12. * sysctl hw.df5545=3 : dereference the STALE ring/DCBAA VAs saved while * the controller was alive — use-after-free read of memory freed by * usb_bus_mem_free_all (may fault; that is the point). * sysctl hw.df5545=5 : make the veto child cooperate. * sysctl hw.df5545=4 : delete the veto child (cooperates post-orphan). */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static device_t xhci_dev; static device_t veto_child; static struct thread *df_td; static volatile int kick; static volatile int cooperate; static volatile int dead; /* ring/DCBAA markers captured while the controller was alive */ static void *ring_va; static uint32_t ring_mark[4]; static void *dctx_va; static uint32_t dctx_mark[4]; static int veto_probe(device_t dev); static int veto_attach(device_t dev); static int veto_detach(device_t dev); static device_method_t veto_methods[] = { DEVMETHOD(device_probe, veto_probe), DEVMETHOD(device_attach, veto_attach), DEVMETHOD(device_detach, veto_detach), DEVMETHOD_END }; static driver_t veto_driver = { "veto", veto_methods, 0 }; static devclass_t veto_devclass; DRIVER_MODULE(veto, xhci, veto_driver, veto_devclass, NULL, NULL); static int veto_probe(device_t dev) { device_set_desc(dev, "DF-5545 detach-veto child"); return (0); } static int veto_attach(device_t dev) { device_printf(dev, "attached to %s; my detach will EBUSY while the " "xhci driver is bound to the parent\n", xhci_dev ? device_get_nameunit(xhci_dev) : "?"); return (0); } static int veto_detach(device_t dev) { if (xhci_dev && device_get_driver(xhci_dev) != NULL && !cooperate) { device_printf(dev, "DETACH VETO: returning EBUSY -- watch " "xhci_pci_detach swallow this and tear down anyway\n"); return (EBUSY); } device_printf(dev, "post-teardown detach (parent orphaned): " "cooperating\n"); return (0); } static void df5545_snapshot(void) { struct xhci_softc *sc = device_get_softc(xhci_dev); ring_va = sc->sc_hw.root_pc.buffer; /* event+command ring page */ dctx_va = sc->sc_hw.ctx_pc.buffer; /* device ctx addr array page */ memcpy(ring_mark, ring_va, sizeof(ring_mark)); memcpy(dctx_mark, dctx_va, sizeof(dctx_mark)); kprintf("DF5545: xhci0 alive: ring VA=%p [%08x %08x %08x %08x] " "DCBAA VA=%p [%08x %08x %08x %08x]\n", ring_va, ring_mark[0], ring_mark[1], ring_mark[2], ring_mark[3], dctx_va, dctx_mark[0], dctx_mark[1], dctx_mark[2], dctx_mark[3]); } static void df5545_cmd1(void) { int err; if (!xhci_dev) { kprintf("DF5545: no xhci device\n"); return; } if (veto_child && !device_is_attached(veto_child)) { kprintf("DF5545: veto child not attached yet, retrying\n"); device_probe_and_attach(veto_child); } df5545_snapshot(); kprintf("DF5545: calling device_detach(%s) [== what " "devclass_delete_driver does on kldunload / PCI hot-unplug]\n", device_get_nameunit(xhci_dev)); err = device_detach(xhci_dev); kprintf("DF5545: device_detach(xhci0) returned %d -- %s\n", err, err ? "honest failure" : "SUCCESS reported DESPITE live veto child (the lie)"); kprintf("DF5545: post: xhci0 driver=%s state=%d\n", device_get_driver(xhci_dev) ? device_get_driver(xhci_dev)->name : "(none)", (int)device_get_state(xhci_dev)); { device_t *list; int count, i; if (device_get_children(xhci_dev, &list, &count) == 0) { kprintf("DF5545: xhci0 STILL has %d child device(s):", count); for (i = 0; i < count; i++) kprintf(" %s(attached=%d)", device_get_nameunit(list[i]), device_is_attached(list[i])); kfree(list, M_TEMP); kprintf("\n"); } } } static void df5545_cmd2(void) { /* * After the swallowed veto, device_set_driver(xhci0, NULL) kfree'd * the softc: device_get_softc() returns NULL and this dereference * is the guaranteed Fatal trap 12. */ struct xhci_softc *sc = device_get_softc(xhci_dev); kprintf("DF5545: post-teardown softc=%p: ring buffer=%p (was %p), " "DCBAA buffer=%p (was %p)\n", sc, sc->sc_hw.root_pc.buffer, ring_va, sc->sc_hw.ctx_pc.buffer, dctx_va); } static void df5545_cmd3(void) { kprintf("DF5545: UAF read of stale ring VA %p: " "%08x %08x %08x %08x (marker %08x %08x %08x %08x)\n", ring_va, ((uint32_t *)ring_va)[0], ((uint32_t *)ring_va)[1], ((uint32_t *)ring_va)[2], ((uint32_t *)ring_va)[3], ring_mark[0], ring_mark[1], ring_mark[2], ring_mark[3]); kprintf("DF5545: UAF read of stale DCBAA VA %p: " "%08x %08x %08x %08x (marker %08x %08x %08x %08x)\n", dctx_va, ((uint32_t *)dctx_va)[0], ((uint32_t *)dctx_va)[1], ((uint32_t *)dctx_va)[2], ((uint32_t *)dctx_va)[3], dctx_mark[0], dctx_mark[1], dctx_mark[2], dctx_mark[3]); } static void df5545_thread(void *arg) { int c; kprintf("DF5545: worker thread ready (sysctl hw.df5545=N)\n"); for (;;) { tsleep(&kick, 0, "df5545", 0); c = kick; kick = 0; switch (c) { case 1: df5545_cmd1(); break; case 2: df5545_cmd2(); break; case 3: df5545_cmd3(); break; case 5: cooperate = 1; kprintf("DF5545: veto child will cooperate on next " "detach\n"); break; case 4: if (veto_child) { int err = device_delete_child(xhci_dev, veto_child); kprintf("DF5545: veto child delete: %d\n", err); if (err == 0) veto_child = NULL; } break; default: break; } if (c == 9) break; } dead = 1; wakeup(&dead); kthread_exit(); } static int df5545_sysctl(SYSCTL_HANDLER_ARGS) { int error, cmd = 0; error = sysctl_handle_int(oidp, &cmd, 0, req); if (error || req->newptr == NULL) return (error); kick = cmd; wakeup(&kick); return (0); } SYSCTL_PROC(_hw, OID_AUTO, df5545, CTLTYPE_INT | CTLFLAG_RW, 0, 0, df5545_sysctl, "I", "DF-5545 harness control (1=detach 2=state 3=UAF 4=cleanup)"); static int veto_modevent(module_t mod, int type, void *data) { devclass_t dc; switch (type) { case MOD_LOAD: dc = devclass_find("xhci"); if (dc == NULL) { kprintf("DF5545: no xhci devclass\n"); return (ENXIO); } xhci_dev = devclass_get_device(dc, 0); if (xhci_dev == NULL) { kprintf("DF5545: no xhci0 device (boot with " "-device qemu-xhci)\n"); return (ENXIO); } kprintf("DF5545: found %s (driver %s)\n", device_get_nameunit(xhci_dev), device_get_driver(xhci_dev) ? device_get_driver(xhci_dev)->name : "(none)"); veto_child = device_add_child(xhci_dev, "veto", -1); if (veto_child == NULL) { kprintf("DF5545: device_add_child failed\n"); return (ENXIO); } /* * The attach may complete asynchronously via the * driver-added event; tolerate a nonzero return here. */ if (device_probe_and_attach(veto_child) != 0) kprintf("DF5545: probe/attach deferred (driver-added " "event will attach)\n"); dead = 0; kthread_create(df5545_thread, NULL, &df_td, "df5545_td"); kprintf("DF5545: harness loaded\n"); return (0); case MOD_UNLOAD: kick = 9; wakeup(&kick); while (!dead) tsleep(&dead, 0, "df5545x", hz / 4); kprintf("DF5545: module unload\n"); return (0); default: return (EOPNOTSUPP); } } static moduledata_t veto_mod = { "veto", veto_modevent, 0 }; DECLARE_MODULE(veto, veto_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE); MODULE_VERSION(veto, 1);