DF-4232 — txp(4) walks device-fed ring cursors unvalidated (OOB descriptor walk, wild rx_sd deref, non-terminating loops)

File: sys/dev/netif/txp/if_txp.c (pass 2) Severity: High (memcorrupt bucket) — hardware-gated (3c990 Typhoon) Status: source-certain; runtime inconclusive (no 3c990 on the guest)

Build / run — same as DF-4231 (see that README); t4232.c prints the sink map.

The bug (two sites, one systemic cause)

All ring cursors live in the DMA-shared hostvar block (struct txp_hostvar, if_txpreg.h:542-554) or in the DMA-shared descriptor rings; the driver consumes them with no range or alignment validation:

1. txp_rx_reclaim() — if_txp.c:658-737. roff = *r->r_roff; woff = *r->r_woff; (device-fed), then rxd = r->r_desc + (roff / sizeof(struct txp_rx_desc)) and while (roff != woff) advancing roff by 16 with an exact-equality wrap at RX_ENTRIES * 16 (2048). A roff/woff outside [0,2048) or not a multiple of 16 ⇒ (a) rxd starts/continues out of bounds past the contigmalloc'd sc_ldata block, (b) the loop can never terminate (roff cycles values never equal to woff) — unbounded walk under the ifnet serializer = livelock, and (c) sd = rxd->rx_sd (if_txp.c:671) reads a kernel pointer stored in DMA memory from OOB memory, then m = sd->sd_mbuf (if_txp.c:673) dereferences it and the wild m is fed to m_copydata/m_freem/if_input (if_txp.c:704-728).

2. txp_response() — if_txp.c:1418-1453. while (ridx != hv->hv_resp_write_idx) with firmware-fed widx; ridx only takes values {0,16,…,496}, so a widx that is not one of those makes the loop cycle forever (console spam + serializer-held livelock). Entry ridx = hv->hv_resp_read_idx (if_txp.c:1393) is also device- writable shared memory: rsp = base + ridx (if_txp.c:1419) is an OOB descriptor read, and rsp->rsp_numdesc from it sizes a kmalloc (if_txp.c:1422) and a bcopy walk (txp_rsp_fixup, if_txp.c:1458-1481).

Siblings already accepted by this audit: DF-3761 (unbounded-walk family). Not covered by DF-1461 (that is the txp_rxbuf_reclaim kfree error path).

Fix

fix.diff: validate/mask cursors to the ring byte size and 16-alignment before walking; bail the descriptor instead of dereferencing garbage.

DF-4232 VERDICT — unvalidated device-fed ring cursors in txp_rx_reclaim()/txp_response()

Verdict: source-certain (High, memcorrupt/unbounded-walk); runtime inconclusive — no 3c990 device on the audit guest (proof in run.log), guest source byte-identical.

Walk 1: receive rings — if_txp.c:649-744

txp_intr() (if_txp.c:624-627) calls txp_rx_reclaim() whenever the device-fed *r->r_woff != *r->r_roff. Both are volatile u_int32_t words of struct txp_hostvar (if_txpreg.h:544-554) inside the DMA-coherent sc_ldata allocation — the Typhoon firmware writes them directly.

if_txp.c:658   roff = *r->r_roff;            // device-fed, unvalidated
if_txp.c:659   woff = *r->r_woff;            // device-fed, unvalidated
if_txp.c:660   rxd = r->r_desc + (roff / sizeof(struct txp_rx_desc));
if_txp.c:662   while (roff != woff) {
if_txp.c:671       sd = rxd->rx_sd;          // kernel ptr read from DMA/OOB mem
if_txp.c:673       m = sd->sd_mbuf;          // wild deref
if_txp.c:676       m->m_pkthdr.len = m->m_len = rxd->rx_len;
if_txp.c:704       m_copydata(m, 0, ..., mtod(mnew, void *));
if_txp.c:732       roff += sizeof(struct txp_rx_desc);
if_txp.c:733       if (roff == (RX_ENTRIES * sizeof(struct txp_rx_desc))) { roff=0; ... }

• Ring is RX_ENTRIES=128 × 16-byte descriptors = 2048 bytes (if_txpreg.h:522).
• roff = 0x7fffffff ⇒ rxd = r_desc + 134217182 — immediately wild; even modest lies (e.g. roff = 2048, woff = 0) walk off the end of the txp_rxhiring array into txp_rxloring/txp_cmdring/txp_rspring/… and past the whole sc_ldata block (next contigmalloc'd pages).
• roff/woff not congruent mod 16, or woff > 2048 ⇒ the exact-equality wrap at :733 never produces roff == woff ⇒ non-terminating walk ⇒ serializer-held livelock (system hang).
• struct txp_rx_desc's rx_sd is a host kernel pointer stored in device-shared memory (if_txpreg.h:268-271, union with u_int64_t) — by design the firmware round-trips it. An OOB rxd therefore feeds a garbage pointer to sd->sd_mbuf; the resulting m is lengthened (:676), copied from (:704), and freed — arbitrary-deref / arbitrary- read-ish primitive, plus NULL-word crashes, entirely device-chosen.

Walk 2: response ring — if_txp.c:1392-1453

txp_command2() polls hv->hv_resp_read_idx vs hv->hv_resp_write_idx (if_txp.c:1393-1394, both device-writable) and calls txp_response(sc, idx, ...) with the unvalidated ridx:

if_txp.c:1418  while (ridx != hv->hv_resp_write_idx) {   // firmware-fed widx
if_txp.c:1419      rsp = (struct txp_rsp_desc *)(((u_int8_t *)sc->sc_rspring.base) + ridx);
if_txp.c:1421      if (id == rsp->rsp_id && rsp->rsp_seq == seq) {
if_txp.c:1422-24       *rspp = kmalloc(sizeof(rsp_desc) * (rsp->rsp_numdesc + 1), ...);
if_txp.c:1427          txp_rsp_fixup(sc, rsp, *rspp);     // bcopy walk

• Response ring is RSP_ENTRIES=32 × 16 = 512 bytes (if_txpreg.h:525). ridx reaching this function is whatever the (shared-memory) read index says — rsp can be anywhere; rsp_numdesc (u_int8_t, ≤ 255) from OOB memory then sizes a ≤ 4 KB kmalloc and a bcopy walk from OOB source.
• Non-termination: txp_rsp_fixup advances ridx by 16 mod 512; if the device holds hv_resp_write_idx at, say, 8, no ridx ever equals it — the loop spins forever (with if_printf("unknown id") console flood) under the serializer: hard DoS from a single DMA word.

Contrast with sibling DFly NIC drivers (fxp, bge, em, re): all mask their device-fed completion indices (idx &= (count-1) or explicit bounds check) before use. txp does not, anywhere.

Exploitability

Malicious/faulty firmware or a passthrough device: pick roff/rx_sd/ridx to aim the wild deref; livelock needs one word. Same hardware-gated threat model as DF-4231/DF-3761 (see DF-3604's precedent discussion).

Runtime evidence (inconclusive)

run.log: driver in kernel (161 pci/if_txp), NO_3COM_PCI_DEVICE, md5 5757b04710b9a2f3b6bbd17196d6df81 == audit tree. The walk cannot be staged without a Typhoon.

Fix

fix.diff: clamp-and-check cursors (size + 16-alignment + ring-bound) at both walk entry points; on violation, reset the cursor to the last known-good value and drop the batch (recovery identical to a chip reset, which the driver already does for TXP_INT_SELF etc.).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.