DF-2300 — missing privilege check in FWOHCI_WRREG/RDREG/PHYREG ioctls

What this is

Verification pack for finding DF-2300 (sys/bus/firewire/fwohci.c:354-392). Medium / operator-group arbitrary OHCI register access. Claim: fwohci_ioctl() (fwohci.c:333-398) services FWOHCI_WRREG / FWOHCI_RDREG / FWOHCI_WRPHYREG / FWOHCI_RDPHYREG / DUMPDMA with no privilege check of any kind; the /dev/fw* nodes are 0660 root:operator, so any operator-group user can program the OHCI DMA engine registers (context command pointers, interrupt masks, HCC link/reset control) and the PHY.

Verdict (short)

REPRODUCED on the verbatim-interposition harness (kernel-compiled, fwohci.c TU-included unmodified): an operator-group user (opuser, gid operator) issued, through the REAL dispatch chain /dev/fw0.0 -> fw_ioctl (fwdev.c:411) -> default: sc->fc->ioctl(ap) (fwdev.c:694) -> fwohci_ioctl (fwohci.c:333):

• FWOHCI_WRREG(0x18c, 0xdeadbee0) — OHCI ATQ DMA context command pointer — rc=0, value stuck in the register file (root cross-check via the rig: MMIO[0x18c]=0xdeadbee0)
• FWOHCI_WRREG(0x88, 0xdeadbee1) — FWOHCI_INTMASK (interrupt mask)
• FWOHCI_WRREG(0x50, 0xdeadbee2) — OHCI_HCCCTL (link control / reset)
• FWOHCI_WRREG(0x00, 0xdeadbee3) — even the version register
• FWOHCI_RDREG read every value back; FWOHCI_WRPHYREG / FWOHCI_RDPHYREG executed the full PHY access sequences unprivileged

No EPERM anywhere. Note: fwdev.c:694 discards fc->ioctl() return values, so even the addr > 0x800 EINVAL of fwohci.c:360 never reaches userspace (the write is still not executed — bounds check works, error report does not).

Rig

The established FireWire verbatim-interposition harness extended to the OHCI side (fwohci_harness.c): fwohci.c compiled unmodified into the harness TU; an emulated MMIO register file stands in for the card (on x86_64 bus_space_read_4/write_4 are direct KVA dereferences, sys/cpu/x86_64/include/bus_dma.h:130-162, so sc->bst=MEM, sc->bsh=&regs gives the real OWRITE/OREAD a live register file); /dev/fw0.0 is created against the stock firewire_ops with stock clone permissions (0660 root:operator).

Reachability honesty

• On real hardware the writable range [0x000,0x800] covers the entire OHCI register file including the DMA ContextCommand/CommandPtr registers: an operator-group user can point AT/AR/IR/IT contexts at attacker-chosen physical addresses, i.e. the classic FireWire arbitrary-physical-memory read/write primitive on non-IOMMU systems, plus controller reset (DoS) and PHY bus disruption. Gate: operator group membership + a FireWire controller (driver auto-attaches on hardware; /dev/fw* clones appear on open).
• On this QEMU guest there is no OHCI hardware; the register file is the rig emulation. The code path is 100% stock, so the missing privilege gate is proven mechanically; the hardware impact ceiling is assessment, not measurement.
• Guest has no IOMMU-relevant config; PRIVESC ASSESSMENT: on real hardware this is a plausible unpriv->root path (DMA to kernel text/ cred memory). It is not demonstrable on the hardware-less guest; the finding stays Medium (operator-gated, hardware-gated) but should be treated as privesc-class on workstations with FireWire ports.

Fix

fix.diff adds caps_priv_check(ap->a_cred, SYSCAP_NODRIVER) (the DF driver-hardware capability gate, cf. sio.c usage) to fwohci_ioctl. A/B validated: patched kernel -> opuser ioctls execute no register access (register file unchanged, PHY untouched); root still allowed.

DF-2300 VERDICT — missing privilege check in fwohci_ioctl

• finding: DF-2300, fwohci.c:354-392 (fwohci_ioctl, fwohci.c:333-398)
• status: reproduced (privilege-gate bypass; operator-group arbitrary OHCI MMIO + PHY access through the unmodified driver code)
• impact: limited_write (attacker-chosen 32-bit values into the OHCI register file, the register file that programs the DMA engine); on real hardware this escalates to the classic FireWire DMA arbitrary-physical-R/W primitive (non-IOMMU) — hardware-gated on this guest, so hardware impact is assessment, not measurement.
• confidence: certain

How it was reproduced

1. Rig: fwohci_harness.c (this pack) #includes the unmodified sys/bus/firewire/fwohci.c; boots a fabricated fwohci_softc whose bst/bsh point at an emulated 0x800-byte register file (fh_regs[]), injects a firewire_softc as unit 0 of the real firewire_devclass, and creates /dev/fw0.0 against the stock firewire_ops with the stock clone permissions 0660 root:operator. fc->ioctl = fwohci_ioctl — the real function.
2. opuser (groups: operator) opens /dev/fw0.0 and issues FWOHCI_WRREG to 0x18c (OHCI_ATQCMD, the async-TX DMA context command pointer), 0x88 (FWOHCI_INTMASK), 0x50 (OHCI_HCCCTL), 0x00 (OHCI_VERSION); every ioctl returns rc=0 and the RDREG read-back returns the attacker value.
3. Root cross-check through the rig control device reads the emulated register file directly: MMIO[0x18c]=0xdeadbee0 etc. — the writes landed exactly where the attacker put them.
4. FWOHCI_WRPHYREG/FWOHCI_RDPHYREG complete the full PHY access sequences (fwphy_wrdata -> fwphy_rddata, fwohci.c:240-331) unprivileged. Rig limitation (documented): the emulated PHY completes accesses on a 1 ms tick while fwphy_wrdata only waits 100 us, so the write data itself can be missed by the emulation; the register-access path and the absence of any privilege check are unaffected (they are the claim being verified).

Path (line-accurate)

• fwohci.c:354-362 FWOHCI_WRREG: OWRITE(fc, reg->addr, reg->data) with only reg->addr <= 0x800 as a bound — no suser/priv/caps check.
• fwohci.c:363-369 FWOHCI_RDREG, 371-378 DUMPDMA, 381-392 PHYREG — same.
• Entry chain: fwdev.c:411 fw_ioctl -> fwdev.c:691-694 default: sc->fc->ioctl(ap); (return value discarded — even the EINVAL at fwohci.c:360 never reaches userspace).
• Device gate: /dev/fw* clones are 0660 root:operator (fwdev.c fwdev_clone semantics, reproduced by the rig node).

Why it matters (threat)

The writable range covers OHCI_HCCCTL (link enable / soft reset / PHY access enable), all four async + 64 iso DMA context control and command-pointer registers, and the interrupt masks. An operator-group user can: (a) reset the controller/PHY (local DoS of the FireWire subsystem + bus disruption), (b) set DMA context command pointers to attacker-controlled physical addresses. OHCI contexts DMA to/from physical memory without an IOMMU translation on typical 2003-era hardware this driver targets (and on any box without VT-d active): that is arbitrary physical read/write — kernel-text/cred overwrite -> uid=0. We could not exercise hardware DMA on the QEMU guest (no OHCI device exists), so the privesc chain is assessment; the register-write primitive itself is mechanically proven with the unmodified driver.

Fix validation (A/B)

fix.diff: if (caps_priv_check(ap->a_cred, SYSCAP_NODRIVER)) return (EPERM); after the a_data check (plus #include <sys/caps.h>). * Baseline kernel (FWO #3): opuser writes land (see run.log). * Fixed kernel (FWO #4): identical opuser commands leave the register file untouched (root regrd shows pre-test values; PHY regs unchanged), root via /dev/fw0.0 still programs registers normally. See run_fixed.log.

Notes

• fwdev.c swallowing fc->ioctl errors is a separate (minor) stock bug observed during verification; the fix.diff returns EPERM before any register access so the swallowed-return does not matter for the gate (no side effect occurs either way).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.