############ MODULE BUILD TEST ############ ### 1. BASELINE (vulnerable) module build ### Warning: Object directory not changed from original /usr/src/sys/netgraph7/netgraph dragonfly -> /usr/src/sys/netgraph7/netgraph/../.. machine_base -> /usr/src/sys/netgraph7/netgraph/../../platform/pc64 machine -> /usr/src/sys/netgraph7/netgraph/../../platform/pc64/include cpu_base -> /usr/src/sys/netgraph7/netgraph/../../cpu/x86_64 cpu -> /usr/src/sys/netgraph7/netgraph/../../cpu/x86_64/include cc -O2 -pipe -D_KERNEL -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wcast-qual -Wold-style-definition -Wmissing-include-dirs -Wno-pointer-sign -Winit-self -Wundef -Wno-unused-but-set-variable -std=gnu11 -Werror -DKLD_MODULE -nostdinc -I. -Idragonfly -I/usr/src/sys/netgraph7/netgraph/forwarder_x86_64/include -Idragonfly/../include -I/usr/include -Wold-style-declaration -fno-common -ffreestanding -fno-stack-protector -fno-strict-aliasing -fno-strict-overflow -fno-asynchronous-unwind-tables -fno-omit-frame-pointer -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float -mno-fp-ret-in-387 -mindirect-branch=thunk-inline -c ng_base.c cc -O2 -pipe -D_KERNEL -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wcast-qual -Wold-style-definition -Wmissing-include-dirs -Wno-pointer-sign -Winit-self -Wundef -Wno-unused-but-set-variable -std=gnu11 -Werror -DKLD_MODULE -nostdinc -I. -Idragonfly -I/usr/src/sys/netgraph7/netgraph/forwarder_x86_64/include -Idragonfly/../include -I/usr/include -Wold-style-declaration -fno-common -ffreestanding -fno-stack-protector -fno-strict-aliasing -fno-strict-overflow -fno-asynchronous-unwind-tables -fno-omit-frame-pointer -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float -mno-fp-ret-in-387 -mindirect-branch=thunk-inline -c ng_parse.c cc -Wl,--build-id=sha1 -nostdlib -Wl,--hash-style=sysv -r -Wl,-d -o netgraph.ko ng_base.o ng_parse.o BASELINE_BUILD=OK ### 2. Apply fix.diff ### Hmm... Looks like a unified diff to me... The text leading up to this was: -------------------------- |diff --git a/sys/netgraph7/netgraph/ng_parse.c b/sys/netgraph7/netgraph/ng_parse.c |--- a/sys/netgraph7/netgraph/ng_parse.c |+++ b/sys/netgraph7/netgraph/ng_parse.c -------------------------- Patching file sys/netgraph7/netgraph/ng_parse.c using Plan A... Hunk #1 succeeded at 1829. done FIX_APPLIED ### 3. FIXED module build ### Warning: Object directory not changed from original /usr/src/sys/netgraph7/netgraph dragonfly -> /usr/src/sys/netgraph7/netgraph/../.. machine_base -> /usr/src/sys/netgraph7/netgraph/../../platform/pc64 machine -> /usr/src/sys/netgraph7/netgraph/../../platform/pc64/include cpu_base -> /usr/src/sys/netgraph7/netgraph/../../cpu/x86_64 cpu -> /usr/src/sys/netgraph7/netgraph/../../cpu/x86_64/include cc -O2 -pipe -D_KERNEL -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wcast-qual -Wold-style-definition -Wmissing-include-dirs -Wno-pointer-sign -Winit-self -Wundef -Wno-unused-but-set-variable -std=gnu11 -Werror -DKLD_MODULE -nostdinc -I. -Idragonfly -I/usr/src/sys/netgraph7/netgraph/forwarder_x86_64/include -Idragonfly/../include -I/usr/include -Wold-style-declaration -fno-common -ffreestanding -fno-stack-protector -fno-strict-aliasing -fno-strict-overflow -fno-asynchronous-unwind-tables -fno-omit-frame-pointer -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float -mno-fp-ret-in-387 -mindirect-branch=thunk-inline -c ng_base.c cc -O2 -pipe -D_KERNEL -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wcast-qual -Wold-style-definition -Wmissing-include-dirs -Wno-pointer-sign -Winit-self -Wundef -Wno-unused-but-set-variable -std=gnu11 -Werror -DKLD_MODULE -nostdinc -I. -Idragonfly -I/usr/src/sys/netgraph7/netgraph/forwarder_x86_64/include -Idragonfly/../include -I/usr/include -Wold-style-declaration -fno-common -ffreestanding -fno-stack-protector -fno-strict-aliasing -fno-strict-overflow -fno-asynchronous-unwind-tables -fno-omit-frame-pointer -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float -mno-fp-ret-in-387 -mindirect-branch=thunk-inline -c ng_parse.c cc -Wl,--build-id=sha1 -nostdlib -Wl,--hash-style=sysv -r -Wl,-d -o netgraph.ko ng_base.o ng_parse.o FIX_BUILD=OK ### 4. Source line comparison ### baseline line 1832: cbuf = kmalloc(strlen(raw) * 4 + 3, M_NETGRAPH_PARSE, fixed line 1832: cbuf = kmalloc(slen * 4 + 3, M_NETGRAPH_PARSE, ### 5. Object size comparison ### -rw-r--r-- 1 root wheel 24648 Jul 16 12:12 /root/ng_parse_fixed.o -rw-r--r-- 1 root wheel 24672 Jul 16 12:12 /root/ng_parse_vuln.o ### 6. strlen call-site count (vuln should have 1 more than fixed) ### VULNERABLE strlen refs: 6 FIXED strlen refs: 5 ### 7. ng_encode_string prologue (vulnerable) — strlen call + lea (,rax,4) ### 0000000000002040 : 2040: 55 push %rbp 2041: 48 89 e5 mov %rsp,%rbp 2044: 41 57 push %r15 2046: 41 56 push %r14 2048: 41 55 push %r13 204a: 41 54 push %r12 204c: 49 89 fc mov %rdi,%r12 204f: 53 push %rbx 2050: 89 f3 mov %esi,%ebx 2052: 48 83 ec 08 sub $0x8,%rsp 2056: e8 00 00 00 00 callq 205b 205b: ba 02 04 00 00 mov $0x402,%edx 2060: 48 c7 c6 00 00 00 00 mov $0x0,%rsi ### 8. ng_encode_string prologue (fixed) — NO strlen call, lea (,rsi,4) ### 0000000000002040 : 2040: 55 push %rbp 2041: ba 02 04 00 00 mov $0x402,%edx 2046: 48 89 e5 mov %rsp,%rbp 2049: 41 57 push %r15 204b: 41 56 push %r14 204d: 41 55 push %r13 204f: 41 54 push %r12 2051: 49 89 fc mov %rdi,%r12 2054: 8d 3c b5 03 00 00 00 lea 0x3(,%rsi,4),%edi 205b: 53 push %rbx 205c: 48 63 ff movslq %edi,%rdi 205f: 89 f3 mov %esi,%ebx 2061: 48 c7 c6 00 00 00 00 mov $0x0,%rsi ### 9. restore guest source to baseline ### restored; line 1832 now: cbuf = kmalloc(strlen(raw) * 4 + 3, M_NETGRAPH_PARSE,