DF-0825 / run.2.log
---run 2--- DF-0825: harness start DF-0825: calling nfs_getnickauth(nmp, cred uid=1001, ...) DF-0825: nickname planted = 0xdeadbeef DF-0825: RPCAKN_NICKNAME = 1, txdr = 0x01000000 DF-0825: nfs_getnickauth returned error=0 DF-0825: auth_str = 0xfffff8008d3846a4, auth_len = 8 DF-0825: auth_str[0..3] = 0xdeadbeef DF-0825: auth_str[4..7] = 0x00000000 (<= OOB heap if bug present) DF-0825: expected[0..3] = 0x00000001 (RPCAKN_NICKNAME) DF-0825: expected[4..7] = 0xdeadbeef (nickname) DF-0825: raw bytes at auth_str: deadbeef 00000000 00000000 00000000 DF-0825: *** BUG CONFIRMED *** DF-0825: auth_str[0] = nickname 0xdeadbeef, NOT RPCAKN_NICKNAME DF-0825: => auth_str points 4 bytes past allocation base DF-0825: => auth_str[4..7] = 0x00000000 is OOB heap read DF-0825: => caller kfree(auth_str) frees non-base ptr => slab corruption DF-0825: now calling kfree(auth_str) to demonstrate slab corruption... DF-0825: kfree returned (no panic => INVARIANTS may be off or slab was lucky) DF-0825: harness done ---run 3--- DF-0825: harness start DF-0825: calling nfs_getnickauth(nmp, cred uid=1001, ...) DF-0825: nickname planted = 0xdeadbeef DF-0825: RPCAKN_NICKNAME = 1, txdr = 0x01000000 DF-0825: nfs_getnickauth returned error=0 DF-0825: auth_str = 0xfffff8004f0c2914, auth_len = 8 DF-0825: auth_str[0..3] = 0xdeadbeef DF-0825: auth_str[4..7] = 0x00000000 (<= OOB heap if bug present) DF-0825: expected[0..3] = 0x00000001 (RPCAKN_NICKNAME) DF-0825: expected[4..7] = 0xdeadbeef (nickname) DF-0825: raw bytes at auth_str: deadbeef 00000000 00000000 00000000 DF-0825: *** BUG CONFIRMED *** DF-0825: auth_str[0] = nickname 0xdeadbeef, NOT RPCAKN_NICKNAME DF-0825: => auth_str points 4 bytes past allocation base DF-0825: => auth_str[4..7] = 0x00000000 is OOB heap read DF-0825: => caller kfree(auth_str) frees non-base ptr => slab corruption DF-0825: now calling kfree(auth_str) to demonstrate slab corruption... DF-0825: kfree returned (no panic => INVARIANTS may be off or slab was lucky) DF-0825: harness done