ath_edma_tx: unvalidated hardware-supplied ts_queue_id used to index sc->sc_txq[]
Summary
ath_edma_tx_processq at if_ath_tx_edma.c:627 bzeros ts then 633 ath_hal_txprocdesc fills ts.ts_queue_id (uint8_t, 0..255) from chip DMA TX status. Filter at 681 only skips beacon q sc_bhalq. Then 684 txq=&sc->sc_txq[ts.ts_queue_id] unchecked subscript on fixed 10-element array (HAL_NUM_TX_QUEUES=10 at ah.h:236). ATH_TXQ_LOCK(txq) 686, ATH_TXQ_FIRST 687, REMOVE 724, depth-- 732 deref OOB pointer. Latent: in-tree HAL emits 0..9. Trigger: faulty HW, PCIe DMA corruption, hostile 802.11 wedging chip, or future HAL bug. Unpriv user drives TX (sendto bcast) keeping completion tasklet firing. A:H DoS panic; speculative memory-corruption via offset ts_queue_id*sizeof(struct ath_txq) into softc. Defense-in-depth bounds check.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1723 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add bounds check ts.ts_queue_id < HAL_NUM_TX_QUEUES before subscript. | 480 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1723 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/netif/ath/ath/if_ath_tx_edma.c:684.
Mechanism
ath_edma_tx_processq indexes sc_txq[ts.ts_queue_id] without bounds check; ts_queue_id is uint8_t 0-255 from chip DMA status but HAL_NUM_TX_QUEUES=10. OOB pointer deref on faulty/hostile HAL.
Fix
Add bounds check ts.ts_queue_id < HAL_NUM_TX_QUEUES before subscript.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
if_ath.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- n
- e
- t
- i
- f
- /
- a
- t
- h
- /
- a
- t
- h
- /
- i
- f
- _
- a
- t
- h
- _
- t
- x
- _
- e
- d
- m
- a
- .
- c
- :
- 6
- 8
- 4
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/netif/ath/ath/if_ath_tx_edma.c:684. Fix compiled clean.
PoC changes
authored fix.diff: bounds check ts_queue_id < HAL_NUM_TX_QUEUES
Verified recommended fix
Add bounds check before array subscript. Matches finding proposal.
Verdict
REPRODUCED (source-only). sc_txq[ts.ts_queue_id] unchecked subscript on 10-element array; uint8_t queue_id 0-255 from chip DMA. Defense-in-depth bounds check.
No comments yet.