DF-4157 — ADC DMA-ring feed trusts the APU CURPTR register as its only bound

File: sys/dev/sound/pci/maestro.c (pass 2, GLM 5.3)

What

The record-channel completion walk derives its ring index exclusively from a device register:

cur = wp_rdapu(ch->parent, 0, APUREG_CURPTR);     /* 16-bit hw register */
cur -= 0xffff & ((ch->srcphys - ch->base) >> 1);  /* unclamped */
...
interleave(ch->src + last, src2 + last, ch->sink + 2*last, cur - last);

(maestro.c:1090-1104, mono variant maestro.c:1128-1139). cur is unsigned; if the register read returns a value below the base offset the subtraction underflows toward 2^32 and interleave()/mixdown() then write 2 int16 per iteration — an unbounded OOB write past the 3*bufsz stat busdma allocation into adjacent kernel memory.

In nominal operation the APU wraps at LOOPLEN so cur ∈ [0, buflen/2) and everything is consistent — the software math is only as good as the register. Desync windows that the driver itself creates:

1. Power-state TOCTOU: agg_intr() tests ess->curpwr <= D1 (maestro.c:1653,1675) without agg_lock, while agg_suspend() / agg_power(..., D3) (maestro.c:821-832, 1985-1995) powers the part down under the lock. An interrupt that already passed the check feeds from a dead register file after pci_set_powerstate(D3).
2. stop/start race: aggch_stop_adc() clears the active bit and sets the APUs INACTIVE under the lock (maestro.c:1046-1053) while agg_intr() may already be past its ess->active & m test and about to chn_intr(ess->rch.channel) → PCMTRIG_EMLDMARD → feed.

The author's own comment ("This function expects n not overwrapping the buffer boundary", maestro.c:1066-1070) documents the trust.

Impact ceiling

Kernel OOB write with attacker-influenced contents (the L/R sample data being interleaved is the recorded audio) and huge length — a corruption primitive, not just a panic, on any machine with a Maestro card when the race hits. Hardware-gated (needs the card + suspend/resume or a stop/rstorm race), hence Medium/likely rather than High.

Guest result

Audit guest has no ESS Maestro PCI function and no /dev/dsp (run.log) — the driver never attaches. untested on this guest; defect is source-certain. wp_rdapu itself even prints "indexing timed out" when the register won't echo (maestro.c:455-456) and still returns whatever PORT_DSP_DATA holds — there is no error propagation either.

Fix

fix.diff: clamp the register-derived index to the ring size in both feed functions (treat desync as "wrapped"). Applies cleanly with git apply.

DF-4157 VERDICT

status: untested (hardware-gated) | impact ceiling: kernel OOB write (corruption primitive)

Reproduced?

No. The audit guest has no Maestro PCI audio function (pciconf -lv), no /dev/dsp (run.log) — the driver never attaches, so the record path cannot be exercised. Source-level certainty for the defect:

• maestro.c:1090-1092 (aggch_feed_adc_stereo) and maestro.c:1129-1131 (aggch_feed_adc_mono): cur = 16-bit APUREG_CURPTR register value minus the 0xffff-masked base offset — no clamp against the ring size before it becomes the sample count of interleave()/mixdown() (maestro.c:1073-1081, 1115-1121), which write 2 int16 / 1 int16 per iteration directly into the 3*ess->bufsz stat busdma buffer (maestro.c:1829).
• Underflow path: register < base offset → cur ≈ 2^32 - k → cur > last branch → interleave(..., cur - last) with n ≈ 4e9 → writes march off the end of the DMA allocation into adjacent kernel memory with recorded-audio contents.
• Software consistency (why it needs desync): LOOPLEN programmed as ch->buflen >> ch->stereo (maestro.c:997,1003) equals the ring sample capacity, so a live, coherent APU wraps in-range. The driver itself creates incoherent windows:
• agg_intr() reads ess->curpwr locklessly (maestro.c:1653) and dispatches chn_intr(rch.channel) → PCMTRIG_EMLDMARD → feed, while agg_suspend()/agg_power(D3) power the part down under agg_lock (maestro.c:821-832, 1989-1992) — post-D3 register reads are garbage.
• aggch_stop_adc() clears active and sets APUs INACTIVE under the lock (maestro.c:1049-1053) racing an interrupt already past its ess->active & m test (maestro.c:1664-1676).
• wp_rdapu() has no error propagation either — on timeout it prints and still returns raw PORT_DSP_DATA (maestro.c:451-458).

Exploit chain (if hardware present)

open /dev/dspN O_RDONLY (0666 via devfs clone) → set AFMT_S16_LE/stereo → read() loop keeps the ADC feeding → concurrently force the power-state race (suspend/resume storm, or stop/start churn of the record channel) → when a desynced CURPTR lands, interleave() smashes adjacent kernel heap with recorded-audio (attacker-chosen int16 pairs) at attacker-influenced length → groom victim objects adjacent to the stat buffer → uid=0. Not demonstrable on this guest; recorded as ceiling.

Fix validation

Not possible on this guest (no hardware). fix.diff clamps the register-derived index in both feed functions; git apply --check passes.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.