DragonFlyBSD Kernel Audit
DF-1064 / fix_run.log
← back to finding ↓ download raw
Warning: Object directory not changed from original /root/poc/DF-1064
cc  -O2 -pipe   -D_KERNEL -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes  -Wmissing-prototypes -Wpointer-arith -Wcast-qual  -Wold-style-definition -Wmissing-include-dirs  -Wno-pointer-sign -Winit-self -Wundef -Wno-unused-but-set-variable -std=gnu11 -Werror -DKLD_MODULE -nostdinc  -I. -Idragonfly -I/root/poc/DF-1064/forwarder_x86_64/include -Idragonfly/../include  -Wold-style-declaration -fno-common -ffreestanding -fno-stack-protector -fno-strict-aliasing -fno-strict-overflow -fno-asynchronous-unwind-tables -fno-omit-frame-pointer -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float -mno-fp-ret-in-387 -mindirect-branch=thunk-inline   -c df1064_harness.c
cc -Wl,--build-id=sha1 -nostdlib -Wl,--hash-style=sysv   -r -Wl,-d -o df1064.ko df1064_harness.o
=== DMESG ===
DF1064: lapic_set_cpuid=0xffffffff80bdd180
DF1064: cpu_id_to_apic_id=0xffffffff818da120  [256]=0xffffffff818da520
DF1064: cpu_id_to_acpi_id=0xffffffff81b25220  [256]=0xffffffff81b25620
DF1064: &lapic_mem=0xffffffff818da520  (low-4-byte alias via [256] of cpu_id_to_apic_id)
DF1064: aliasing check: &cpu_id_to_apic_id[256]==(int*)&lapic_mem ? YES
DF1064: BEFORE OOB: cpu_id_to_apic_id[256]=0  lapic_mem=0  cpu_id_to_acpi_id[256]=0x0  apic_id_to_cpu_id[1]=1
DF1064: direct-OOB: CPUID_TO_ACPIID(256)=0xDF1064 -> cpu_id_to_acpi_id[256] clobbered (OOB CONFIRMED)
lapic_set_cpuid: invalid cpu_id 256 apic_id 1, skipping
DF1064: lapic_set_cpuid(256,1): lapic_mem low word unchanged (lapic_set_cpuid rejected OOB (FIXED kernel?))
DF1064: AFTER restore: cpu_id_to_apic_id[256]=0  lapic_mem=0  cpu_id_to_acpi_id[256]=0x0  apic_id_to_cpu_id[1]=1
DF1064: SUMMARY: OOB WRITE CONFIRMED -- cpu-dimension OOB at index 256 in cpu_id_to_apic_id (->lapic_mem low word) and cpu_id_to_acpi_id (->madt_use_x2apic)