⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-4519

ar5212_xmit: TX-queue index q validated only by inert HALASSERT in 5 exported xmit ops; signed q<0 bypasses the >=-only checks in Set/GetTxQueueProps down to &ah_txq[q]

Summary

Five exported xmit ops gate q only via HALASSERT (no-op in production), unlike siblings with real checks; Set/GetTxQueueProps take signed q and check only >=, so negative q reaches &ah_txq[q] and ath_hal_setTxQProps reads qi->tqi_type then writes many fields through the OOB pointer - plus UB 1<<q and unchecked AR_Q*(q) MMIO. No unpriv trigger today (all callers pass internal 0..9) - latent primitive for future/buggy HAL callers. DF-2201/2073 lineage. Fix build-validated (-Werror nativekernel). Real-runtime-checks fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-4519 · 6 files
FileTypeDescriptionSize
VERDICT.md verdict full analysis + reachability 2.7 KB ↓ raw
verdict.json verdict-machine persist_poc.py input 3.2 KB view raw
fix.diff suggested-fix runtime q checks in the 5 assert-only ops + q<0 rejection in Set/GetTxQueueProps 2.5 KB view raw
build.log build-log full nativekernel log, BUILD_RC=0, -Werror (shared with DF-4520 build) 5.1 MB ↓ download
build.sh script build validation steps 147 B view raw
run.sh script no-op: HW-gated, see VERDICT.md 149 B view raw
VERDICT.md verdict full analysis + reachability
↓ download raw

DF-4519 — ar5212_xmit.c TX-queue index validated only by inert HALASSERT (+ signed-q hole)

What

sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c:

  • ar5212GetTxDP (line 517), ar5212SetTxDP (line 527), ar5212StartTxDma (line 547), ar5212NumTxPending (line 569), ar5212StopTxDma (line 594) validate the queue index q only via HALASSERT(q < halTotalQueues). HALASSERT expands to nothing unless AH_ASSERT is defined (sys/dev/netif/ath/ath_hal/ah_internal.h:669-676); AH_ASSERT is only in sys/config/LINT64, not in X86_64_GENERIC — same proof as DF-2201. Their sibling functions (ar5212SetTxQueueProps:91, ar5212GetTxQueueProps:109, ar5212ReleaseTxQueue:237, ar5212ResetTxQueue:277) DO real runtime checks.
  • ar5212SetTxQueueProps(ah, int q, ...) (line 86) and ar5212GetTxQueueProps(ah, int q, ...) (line 103) take a signed q and check only q >= pCap->halTotalQueues — a negative q passes the check and flows into &ahp->ah_txq[q] (lines 96/114). ath_hal_setTxQProps (sys/dev/netif/ath/ath_hal/ah.c:951+) reads qi->tqi_type and then writes tqi_ver/subtype/qflags/priority/aifs/cwmin/... through that pointer → OOB read+write below ah_txq[0] (inside the heap-allocated struct ath_hal_5212).
  • With an out-of-range q, the inert-assert functions compute 1 << q (UB shift for q ≥ 32) and unchecked AR_Q*(q) MMIO addresses.

Reachability (honest)

All callers today are in-kernel driver code (if_ath) using internally-allocated queue numbers (ath_hal_setuptxqueue return value, 0..9). No userland path passes a raw q. This is the corpus's established HALASSERT-inert class (DF-2201 ar5212_gpio, DF-2073 ar5212_keycache): latent OOB / UB, no demonstrated unprivileged trigger. Low / likely.

Severity rationale

Low — hardening/latent memory-safety gap in exported HAL ops vectors; reachable only through a driver bug or a future caller passing an unvalidated index.

Reproduce (build validation only)

See build.sh / build.log: the fix.diff was applied to the guest /usr/src and a full make nativekernel KERNCONF=X86_64_GENERIC completed rc=0 with -Werror (ar5212_xmit.o rebuilt into both kernel and ath_hal module).

No runtime trigger exists on the audit guest (no Atheros NIC), matching the DF-2201/DF-1766 protocol for HW-gated HAL findings.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Fix verification

fixed
baseline no→ patch + rebuild →patched clean

build-only validation (runtime HW-gated): fix.diff applied to guest /usr/src; make nativekernel KERNCONF=X86_64_GENERIC rc=0 with -Werror; ar5212_xmit.o rebuilt into kernel and module objects (build.log:7157,13453,14895-14897). Baseline/patched runtime not reproducible without an Atheros NIC.

findings/poc/DF-4519/build.log (full untrimmed nativekernel log, BUILD_RC=0; decisive lines 3, 7157, 13453, 14895, 14897)
↓ fix.diffper-fix-DF-4519

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

HALASSERT expands to nothing without AH_ASSERT (ah_internal.h:669-676; only LINT64 defines AH_ASSERT); ar5212GetTxDP/SetTxDP/StartTxDma/NumTxPending/StopTxDma have no other q check; SetTxQueueProps/GetTxQueueProps take signed int q and only check q >= halTotalQueues, so q<0 reaches &ah_txq[q] and ath_hal_setTxQProps (ah.c:951) writes through it. Fix build-validated: nativekernel rc=0 -Werror (build.log lines 7157/13453/14897).

PoC changes

n/a (no runtime PoC attempted; source-only confirmation per DF-2201/DF-1766 HW-gated protocol)

Verified recommended fix

Replace the inert HALASSERT bounds checks in ar5212GetTxDP/SetTxDP/StartTxDma/NumTxPending/StopTxDma with runtime checks (return 0/AH_FALSE on bad q) and reject q<0 in ar5212SetTxQueueProps/ar5212GetTxQueueProps.

Verdict

untested (runtime): the five HAL xmit ops validate q only via HALASSERT (compiled out of production kernels) and Set/GetTxQueueProps let a signed negative q through their >= check down to &ah_txq[q]; all current callers pass driver-internal indexes 0..9, so no trigger exists on the guest (no Atheros NIC). Source-confirmed defect; fix.diff adds real runtime checks and build-validated rc=0 -Werror.