DragonFlyBSD Kernel Audit
DF-0852 / fix_run.log
← back to finding ↓ download raw
=== PATCHED KERNEL: overflow case (VSS=0x7FFFFFF0, ssector=16) -> expect REJECTED (EINVAL), NO bogus f_blocks ===
[poc] dev=/dev/vn0 mnt=/tmp/df0852_mnt ssector=16 (0x10)  sizeof(int)=4 INT_MAX=2147483647
[poc] 16+ssector=32   100+ssector=116
[poc] mount() rc=-1 errno=22 (Invalid argument)
[poc] mount failed; overflow arithmetic may still have executed inside the kernel before the failure.
RC=1
(2nd run for determinism)
[poc] dev=/dev/vn0 mnt=/tmp/df0852_mnt ssector=16 (0x10)  sizeof(int)=4 INT_MAX=2147483647
[poc] 16+ssector=32   100+ssector=116
[poc] mount() rc=-1 errno=22 (Invalid argument)
[poc] mount failed; overflow arithmetic may still have executed inside the kernel before the failure.
RC=1

=== PATCHED KERNEL: loop-overflow case (ssector=INT_MAX) -> expect REJECTED (EINVAL) up front ===
[poc] dev=/dev/vn0 mnt=/tmp/df0852_mnt ssector=2147483647 (0x7fffffff)  sizeof(int)=4 INT_MAX=2147483647
[poc] 16+ssector=-2147483633   100+ssector=-2147483549
[poc] mount() rc=-1 errno=22 (Invalid argument)
[poc] mount failed; overflow arithmetic may still have executed inside the kernel before the failure.
RC=1

=== PATCHED KERNEL: normal case (VSS=100, ssector=0) -> expect SUCCESS, f_blocks=100 (no regression) ===
[poc] dev=/dev/vn0 mnt=/tmp/df0852_mnt ssector=0 (0x0)  sizeof(int)=4 INT_MAX=2147483647
[poc] 16+ssector=16   100+ssector=100
[poc] mount() rc=0 errno=2 (No such file or directory)
[poc] statfs f_blocks = 100  (0x64)  f_bsize=2048
[poc] f_blocks looks normal (no overflow on this path)
RC=0