DragonFlyBSD Kernel Audit
DF-0755 / run.log
← back to finding ↓ download raw
############ UNFIXED race_harness (3 runs) ############
-- run 1 --
TCP_NDEBUG (array bound) = 100
max slot index used      = 10301768
OOB writes (slot>=100)   = 10126283
RESULT: RACE TRIGGERED -- index ran away past tcp_debug[] bound
=> the unlocked tcp_debx++ / wrap-check pattern is unsafe on SMP
-- run 2 --
TCP_NDEBUG (array bound) = 100
max slot index used      = 7675527
OOB writes (slot>=100)   = 7569677
RESULT: RACE TRIGGERED -- index ran away past tcp_debug[] bound
=> the unlocked tcp_debx++ / wrap-check pattern is unsafe on SMP
-- run 3 --
TCP_NDEBUG (array bound) = 100
max slot index used      = 11964557
OOB writes (slot>=100)   = 11797750
RESULT: RACE TRIGGERED -- index ran away past tcp_debug[] bound
=> the unlocked tcp_debx++ / wrap-check pattern is unsafe on SMP

############ FIXED race_harness_fixed (3 runs) ############
-- run 1 --
TCP_NDEBUG (array bound) = 100
max slot index used      = 99
OOB writes (slot>=100)   = 0
RESULT: INDEX BOUNDED -- spinlock keeps tcp_debx in [0,99]
=> fix closes the race; no OOB write possible
-- run 2 --
TCP_NDEBUG (array bound) = 100
max slot index used      = 99
OOB writes (slot>=100)   = 0
RESULT: INDEX BOUNDED -- spinlock keeps tcp_debx in [0,99]
=> fix closes the race; no OOB write possible
-- run 3 --
TCP_NDEBUG (array bound) = 100
max slot index used      = 99
OOB writes (slot>=100)   = 0
RESULT: INDEX BOUNDED -- spinlock keeps tcp_debx in [0,99]
=> fix closes the race; no OOB write possible

############ exit summary ############
unfixed: always max_slot in millions, ~8M OOB writes/run
fixed:   always max_slot=99, 0 OOB writes/run