/* * harness2.c -- KLD harness for the pass-2 audit of sys/netbt/hci_misc.c * (finding DF-5780: unsynchronized hci_memos list -> concurrent * hci_memo_find walkers double-free / UAF hci_memo records). * * The FULL production netbt stack (all sys/netbt sources, copied by * build.sh, md5s recorded) is compiled into this module: bt_proto.c * registers the real PF_BLUETOOTH domain and the real NETISR_BLUETOOTH * handler, so real * * socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP); connect(...) * * from an ordinary unprivileged userland process reaches the production * l2cap_connect() -> hci_route_lookup() -> hci_memo_find() walk in the * caller's process context (any CPU). * * This harness plays only the controller-driver role (what ubt(4)/ * btuart(4) play in production): it attaches one unit through the * production hci_attach() and feeds HCI event packets through the * production input entry point * * hci_input_event() -> netisr(NETISR_BLUETOOTH) -> btintr() * -> hci_intr() -> hci_event() -> hci_event_inquiry_result() * -> hci_memo_new() -> hci_memo_find() [netisr-0 context] * * Triggers (sysctl, as root): * * hw.hcir_setup = 1 attach fake unit, mark it UP/RUNNING * (the state after admin "btconfig hci0 up"; * BTF_UP is what hci_route_lookup() tests) * hw.hcir_seed = N inject N Inquiry Result events (16 unique * bdaddrs each) -> N*16 hci_memo records * via the production event path * hw.hcir_flood = 1/0 start/stop a kthread that continuously * injects inquiry events (the netisr-side * hci_memo_find walker + fresh-memo churn) * hw.hcir_memos = 1 print current memo count on the unit * hw.hcir_check_dup = N allocate N live 48-byte blocks (same size * class/zone as struct hci_memo), check for * duplicate addresses among LIVE allocations * (proof of double-free / freelist corruption) * hw.hcir_debug = N set netbt bluetooth_debug (DPRINTF between * the expiry check and hci_memo_free widens * the race window when != 0) */ #include #include #include #include #include #include #include #include #include #include #include #include #include /* struct bsd_device */ #include #include /* ------------------------------------------------------------------ */ /* fake controller driver: the role ubt(4)/btuart(4) play */ static int fake_enable(device_t); static void fake_disable(device_t); static void fake_output_cmd(device_t, struct mbuf *); static void fake_output_acl(device_t, struct mbuf *); static void fake_output_sco(device_t, struct mbuf *); static void fake_get_stats(device_t, struct bt_stats *, int); static const struct hci_if fake_hci_if = { fake_enable, fake_disable, fake_output_cmd, fake_output_acl, fake_output_sco, fake_get_stats, }; static int fake_enable(device_t dev) { return 0; } static void fake_disable(device_t dev) { } static void fake_output_cmd(device_t dev, struct mbuf *m) { /* controller would answer CREATE_CON etc; we just drop */ m_freem(m); } static void fake_output_acl(device_t dev, struct mbuf *m) { m_freem(m); } static void fake_output_sco(device_t dev, struct mbuf *m) { m_freem(m); } static void fake_get_stats(device_t dev, struct bt_stats *s, int arg) { memset(s, 0, sizeof(*s)); } /* ------------------------------------------------------------------ */ static struct hci_unit *g_unit; static device_t fake_dev; /* * Fabricate a minimal struct bsd_device so that the production * DPRINTF paths (device_get_nameunit / device_printf, enabled when * bluetooth_debug != 0) dereference valid memory. Only nameunit and * desc are ever read by the netbt debug prints. */ static device_t make_fake_device(void) { struct bsd_device *dev; static char nameunit[] = "hci0"; static char desc[] = "hcir fake controller"; dev = kmalloc(sizeof(*dev), M_TEMP, M_ZERO | M_WAITOK); KKASSERT(dev != NULL); dev->nameunit = nameunit; dev->desc = desc; return (device_t)dev; } static int flood_run; static struct thread *flood_td; static volatile uint16_t bdctr; /* * Build an mbuf carrying a complete HCI event packet (exactly what a * controller RX URB delivers) and hand it to the production input path. */ static void inject_event(const uint8_t *pkt, int len) { struct mbuf *m; m = m_gethdr(M_NOWAIT, MT_DATA); KKASSERT(m != NULL); if (m_copyback2(m, 0, len, pkt, M_NOWAIT) != 0) { kprintf("[hcir] m_copyback2 failed\n"); m_freem(m); return; } hci_input_event(g_unit, m); /* production entry point */ } static int wait_eventq_drain(int secs) { int t; for (t = 0; t < secs * 10; t++) { if (g_unit->hci_eventqlen == 0 && IF_QEMPTY(&g_unit->hci_eventq)) return 1; tsleep(g_unit, 0, "hcirw", hz / 10); } return (g_unit->hci_eventqlen == 0); } static int memo_count(void) { struct hci_memo *memo; int n = 0; LIST_FOREACH(memo, &g_unit->hci_memos, next) n++; return n; } /* build one Inquiry Result event with nresp responses (unique bdaddrs) */ static int build_inquiry_pkt(uint8_t *pkt, int nresp) { int off = 0, resp, i; pkt[off++] = 0x04; pkt[off++] = 0x02; /* HCI_EVENT_INQUIRY_RESULT */ pkt[off++] = 1 + nresp * 14; pkt[off++] = nresp; for (resp = 0; resp < nresp; resp++) { pkt[off++] = bdctr & 0xff; pkt[off++] = (bdctr >> 8) & 0xff; bdctr++; for (i = 0; i < 4; i++) pkt[off++] = 0xc0 + i; pkt[off++] = 0x01; /* page_scan_rep_mode */ pkt[off++] = 0x00; /* page_scan_period */ pkt[off++] = 0x00; /* page_scan_mode */ pkt[off++] = 0x22; /* uclass[3] */ pkt[off++] = 0x22; pkt[off++] = 0x22; pkt[off++] = 0x11; /* clock_offset lo/hi */ pkt[off++] = 0x11; } return off; } /* ------------------------------------------------------------------ */ /* setup */ static int hcir_setup(SYSCTL_HANDLER_ARGS) { int v = 0, err; err = sysctl_handle_int(oidp, &v, 0, req); if (err != 0 || req->newptr == NULL || v == 0) return err; if (g_unit != NULL) { kprintf("[hcir] unit already attached\n"); return 0; } kprintf("[hcir] === setup: attach unit via production hci_attach() ===\n"); fake_dev = make_fake_device(); g_unit = hci_attach(&fake_hci_if, fake_dev, 0); KKASSERT(g_unit != NULL); /* * State after "btconfig hci0 up": unit initialised, enabled and * BTF_UP set (this is what hci_route_lookup()/hci_unit_lookup() * test, set by SIOCSBTFLAGS in production: hci_ioctl.c:242). */ g_unit->hci_flags |= BTF_UP | BTF_RUNNING; g_unit->hci_num_cmd_pkts = 1; /* environment: allow larger event bursts (production tunable, * sysctl-less in this tree: sys/netbt/hci_unit.c:56) */ hci_eventq_max = 512; kprintf("[hcir] unit %p attached, flags=%#x\n", g_unit, g_unit->hci_flags); return 0; } SYSCTL_PROC(_hw, OID_AUTO, hcir_setup, CTLTYPE_INT | CTLFLAG_RW, 0, 0, hcir_setup, "I", "attach fake HCI unit (UP+RUNNING)"); /* ------------------------------------------------------------------ */ /* seed expired memos via the production event path */ static int hcir_seed(SYSCTL_HANDLER_ARGS) { uint8_t pkt[3 + 1 + 16 * 14]; int v = 0, err, ev, before, after, off; err = sysctl_handle_int(oidp, &v, 0, req); if (err != 0 || req->newptr == NULL || v == 0) return err; KKASSERT(g_unit != NULL); before = memo_count(); kprintf("[hcir] === seed: %d Inquiry Result events (16 responses " "each) -> hci_memo_new() ===\n", v); kprintf("[hcir] memos before: %d\n", before); for (ev = 0; ev < v; ev++) { off = build_inquiry_pkt(pkt, 16); inject_event(pkt, off); } if (!wait_eventq_drain(30)) { kprintf("[hcir] event queue did not drain!\n"); return 0; } after = memo_count(); kprintf("[hcir] memos after: %d\n", after); return 0; } SYSCTL_PROC(_hw, OID_AUTO, hcir_seed, CTLTYPE_INT | CTLFLAG_RW, 0, 0, hcir_seed, "I", "seed memos via production inquiry events"); /* ------------------------------------------------------------------ */ /* continuous netisr-side walker (inquiry event flood) */ static void flood_thread(void *arg) { uint8_t pkt[3 + 1 + 16 * 14]; int off, i, tick; kprintf("[hcir] flood thread started (netisr-side hci_memo_find " "walker + memo churn; 4 events/tick, 3/4 repeated bdaddrs -> " "hci_memo_new takes the found/update path)\n"); tick = 0; while (flood_run) { for (i = 0; i < 4; i++) { if ((tick++ & 3) == 3) bdctr += 16; /* fresh bdaddrs: new memos */ /* else: repeat the previous 16 -> find MATCH -> * hci_memo_new returns existing memo and writes * memo->time (the UAF-write candidate path) */ off = build_inquiry_pkt(pkt, 16); inject_event(pkt, off); } tsleep(g_unit, 0, "hcirf", 1); } kprintf("[hcir] flood thread stopped\n"); wakeup(&flood_td); kthread_exit(); } /* * Burst: inject N events back-to-back so netisr-0 runs N x 16 * hci_memo_new -> hci_memo_find walks over the (all-expired) list * while user walkers are demolishing it too. */ static int hcir_burst(SYSCTL_HANDLER_ARGS) { uint8_t pkt[3 + 1 + 16 * 14]; int v = 0, err, i, off; err = sysctl_handle_int(oidp, &v, 0, req); if (err != 0 || req->newptr == NULL || v == 0) return err; KKASSERT(g_unit != NULL); kprintf("[hcir] burst: %d events (%d walks) into netisr\n", v, v * 16); for (i = 0; i < v; i++) { off = build_inquiry_pkt(pkt, 16); inject_event(pkt, off); } return 0; } SYSCTL_PROC(_hw, OID_AUTO, hcir_burst, CTLTYPE_INT | CTLFLAG_RW, 0, 0, hcir_burst, "I", "burst N inquiry events into netisr"); static int hcir_flood(SYSCTL_HANDLER_ARGS) { int v = 0, err; err = sysctl_handle_int(oidp, &v, 0, req); if (err != 0 || req->newptr == NULL) return err; KKASSERT(g_unit != NULL); if (v && !flood_run) { flood_run = 1; err = kthread_create(flood_thread, NULL, &flood_td, "hcir_flood"); if (err) flood_run = 0; } else if (!v && flood_run) { flood_run = 0; wakeup(g_unit); tsleep(&flood_td, 0, "hcirj", 5 * hz); } return err; } SYSCTL_PROC(_hw, OID_AUTO, hcir_flood, CTLTYPE_INT | CTLFLAG_RW, 0, 0, hcir_flood, "I", "continuous inquiry event flood (1=start 0=stop)"); /* ------------------------------------------------------------------ */ static int hcir_memos(SYSCTL_HANDLER_ARGS) { int v = 0, err; err = sysctl_handle_int(oidp, &v, 0, req); if (err != 0 || req->newptr == NULL || v == 0) return err; kprintf("[hcir] memos on unit: %d\n", memo_count()); return 0; } SYSCTL_PROC(_hw, OID_AUTO, hcir_memos, CTLTYPE_INT | CTLFLAG_RW, 0, 0, hcir_memos, "I", "print memo count"); /* ------------------------------------------------------------------ */ /* duplicate-allocation detector: proof of double-free / freelist */ /* corruption in the 48-byte size class (struct hci_memo's class). */ /* kmalloc zones are GLOBAL PER SIZE CLASS in DragonFly (zoneindex(), */ /* kern_slaballoc.c:638 -- no type parameter), so any two live */ /* allocations handed the SAME address are a kernel-wide aliasing */ /* primitive. */ static int cmp_ptrs(const void *a, const void *b) { void * const *pa = a, * const *pb = b; if (*pa < *pb) return -1; if (*pa > *pb) return 1; return 0; } static int hcir_check_dup(SYSCTL_HANDLER_ARGS) { void **a; uint8_t *p; int v = 0, err, i, n, dups = 0; err = sysctl_handle_int(oidp, &v, 0, req); if (err != 0 || req->newptr == NULL || v == 0) return err; n = v; a = kmalloc(n * sizeof(void *), M_TEMP, M_WAITOK); KKASSERT(a != NULL); for (i = 0; i < n; i++) { /* sizeof(struct hci_memo) == 48: same global size class */ p = kmalloc(48, M_BLUETOOTH, M_NOWAIT | M_ZERO); if (p == NULL) { kprintf("[hcir] kmalloc failed at %d\n", i); n = i; break; } *(uint64_t *)p = 0xCAFEBABE00000000UL + i; a[i] = p; } kqsort(a, n, sizeof(void *), cmp_ptrs); for (i = 1; i < n; i++) { if (a[i] == a[i - 1]) { kprintf("[hcir] *** DUPLICATE LIVE ALLOCATION: %p " "(blocks %d and %d) -- DOUBLE-FREE CONFIRMED, " "two owners of one 48-byte kernel block\n", a[i], i - 1, i); dups++; } } if (dups == 0) kprintf("[hcir] check_dup: %d live 48B blocks, no duplicate " "addresses (freelist clean at this instant)\n", n); for (i = 0; i < n; i++) { p = a[i]; if (dups && *(uint64_t *)p >> 32 != 0xCAFEBABEL) kprintf("[hcir] block %d (%p) canary clobbered: " "%016jx\n", i, p, (uintmax_t)*(uint64_t *)p); kfree(p, M_BLUETOOTH); } kfree(a, M_TEMP); kprintf("[hcir] check_dup done: %d duplicate(s)\n", dups); return 0; } SYSCTL_PROC(_hw, OID_AUTO, hcir_check_dup, CTLTYPE_INT | CTLFLAG_RW, 0, 0, hcir_check_dup, "I", "N live 48B kmallocs -> detect dup addrs"); /* ------------------------------------------------------------------ */ static int hcir_debug(SYSCTL_HANDLER_ARGS) { int v = 0, err; err = sysctl_handle_int(oidp, &v, 0, req); if (err != 0 || req->newptr == NULL) return err; bluetooth_debug = v; kprintf("[hcir] bluetooth_debug = %d\n", bluetooth_debug); return 0; } SYSCTL_PROC(_hw, OID_AUTO, hcir_debug, CTLTYPE_INT | CTLFLAG_RW, 0, 0, hcir_debug, "I", "set netbt bluetooth_debug"); /* ------------------------------------------------------------------ */ /* live corruption watchdog: while the race is running, continuously */ /* (a) time a production hci_memo_find() walk (circular/self-linked */ /* list from a double-inserted block => WALK STUCK), and */ /* (b) allocate batches of canary'd 48-byte blocks and check for */ /* duplicate live addresses or clobbered canaries (double-free */ /* freelist dup, or aliasing with a concurrently-written */ /* hci_memo that overwrites offset 0 via microtime). */ static int dup_hits, canary_hits, stuck_hits; static int dup_batch_check(int n) { void **a; uint8_t *p; int i, dups = 0; a = kmalloc(n * sizeof(void *), M_TEMP, M_WAITOK); KKASSERT(a != NULL); for (i = 0; i < n; i++) { p = kmalloc(48, M_BLUETOOTH, M_NOWAIT | M_ZERO); if (p == NULL) { n = i; break; } *(uint64_t *)p = 0xCAFEBABE00000000UL + i; a[i] = p; } kqsort(a, n, sizeof(void *), cmp_ptrs); for (i = 1; i < n; i++) { if (a[i] == a[i - 1]) { kprintf("[hcir] *** LIVE DUP: %p (blocks %d,%d): " "DOUBLE-FREE PRESENT IN 48B ZONE FREELIST\n", a[i], i - 1, i); dups++; } } for (i = 0; i < n; i++) { p = a[i]; if (*(uint64_t *)p >> 32 != 0xCAFEBABEL) { kprintf("[hcir] *** CANARY CLOBBERED: block %d (%p) " "now %016jx -- block handed out twice and " "written by another owner\n", i, p, (uintmax_t)*(uint64_t *)p); dups++; } } for (i = 0; i < n; i++) kfree(a[i], M_BLUETOOTH); kfree(a, M_TEMP); return dups; } static int wd_run; static struct thread *wd_td; static void watchdog_thread(void *arg) { struct timeval t0, t1; bdaddr_t probe; int64_t usec; kprintf("[hcir] watchdog started\n"); memset(&probe, 0xab, sizeof(probe)); while (wd_run) { /* (a) walk probe */ getmicrotime(&t0); hci_memo_find(g_unit, &probe); getmicrotime(&t1); usec = (t1.tv_sec - t0.tv_sec) * 1000000 + (t1.tv_usec - t0.tv_usec); if (usec > 2000000) { kprintf("[hcir] *** WALK STUCK: hci_memo_find took " "%jd us (circular memo list?)\n", (intmax_t)usec); stuck_hits++; } /* (b) freelist dup / aliasing probe */ if (dup_batch_check(512)) dup_hits++; tsleep(g_unit, 0, "hcirwd", 2); } kprintf("[hcir] watchdog stopped (dup=%d canary-in-dup=%d " "stuck=%d)\n", dup_hits, canary_hits, stuck_hits); wakeup(&wd_td); kthread_exit(); } static int hcir_watchdog(SYSCTL_HANDLER_ARGS) { int v = 0, err; err = sysctl_handle_int(oidp, &v, 0, req); if (err != 0 || req->newptr == NULL) return err; KKASSERT(g_unit != NULL); if (v && !wd_run) { dup_hits = canary_hits = stuck_hits = 0; wd_run = 1; err = kthread_create(watchdog_thread, NULL, &wd_td, "hcir_wdog"); if (err) wd_run = 0; } else if (!v && wd_run) { wd_run = 0; wakeup(g_unit); tsleep(&wd_td, 0, "hcirj2", 2 * hz); kprintf("[hcir] watchdog totals: dup=%d stuck=%d\n", dup_hits, stuck_hits); } return err; } SYSCTL_PROC(_hw, OID_AUTO, hcir_watchdog, CTLTYPE_INT | CTLFLAG_RW, 0, 0, hcir_watchdog, "I", "live corruption watchdog (1=start 0=stop)"); /* ------------------------------------------------------------------ */ static int harness_mode(module_t mod, int type, void *data) { switch (type) { case MOD_LOAD: /* bt_proto.c SYSINITs (compiled in verbatim) registered the * PF_BLUETOOTH domain, netbt sysctls and NETISR_BLUETOOTH */ kprintf("[hcir] hci_race_harness loaded (full production " "netbt stack): hcir_setup, hcir_seed, hcir_flood, " "hcir_memos, hcir_check_dup, hcir_debug\n"); break; case MOD_UNLOAD: return EBUSY; default: break; } return 0; } static moduledata_t harness_moddata = { "hci_race_harness", harness_mode, NULL }; DECLARE_MODULE(hci_race_harness, harness_moddata, SI_SUB_DRIVERS, SI_ORDER_MIDDLE);