DF-2216 / run.first_meterbug.log
[run] kernel: DFV22X 600519 kern.df22x_run: 0 -> 0 --- run_extract.log --- DF22X RIG start ========================================= DF2216 start: N=16384 per-call kgetenv alloc=101 bytes (kern_environment.c:242) DF2216 CONTROL paired kgetenv+kfreeenv x16384: memuse delta=1573720 calls delta=16384 (expect ~0 / 16384) DF2216 BASELINE dmi_match x16384 (matchret=1 mismatchret=0): memuse delta=3408808 calls delta=16384 leaked-bytes-per-call=208 DF2216 BASELINE arm smbios.system.maker single call: memuse delta=104 DF2216 BASELINE arm smbios.planar.maker single call: memuse delta=104 DF2216 BASELINE arm smbios.system.product single call: memuse delta=104 DF2216 BASELINE arm smbios.planar.product single call: memuse delta=104 DF2216 FIXED dmi_match_fixed x16384 (matchret=1 mismatchret=0): memuse delta=1704872 calls delta=16384 DF2216 VERDICT: baseline leaked 3408808 bytes in 16384 calls (control 1573720, fixed 1704872) -> UNEXPECTED (inspect) DF22X ---- DF2220 start: N=16384 init/release cycles, name via verbatim kvasprintf (drm_dragonfly.c:67-84, M_DRM) DF2220 CONTROL paired kmalloc/kfree x16384: memuse delta=524288 (expect 0) DF2220 BASELINE kobject_init_and_add+kobject_put x16384: memuse delta=1703968 kmalloc-calls delta=32768 releases=16384 leaked-bytes-per-cycle=104 DF2220 BASELINE init:+131104 after_release:+131104 name ptr still valid, content=[leaked_name_probe_0123456789] len=28 (allocation SURVIVED release) DF2220 FIXED init:+32 after_release_fixed:+0 (name freed by the patch) DF2220 FIXED init+release_fixed x16384: memuse delta=1179680 kmalloc-calls delta=32768 releases=16384 DF2220 VERDICT: baseline leaked 1703968 bytes in 16384 cycles (control 524288, fixed 1179680) -> UNEXPECTED (inspect) DF22X ---- DF2223 start: real guest PCI devices drive the real pcie_capability_read_dword (linux_pci.c:30-39) with the real predicate chain (linux/pci.h:473-495, pci_is_pcie, real config reads) DF2223 BASELINE hostb0 LNKCAP rc=-22 dst=0xa5a5a5a5 UNTOUCHED-CANARY (dst left uninitialized) DF2223 BASELINE hostb0 pcie_get_width_cap-style consumer: lnkcap=0xa5a5a5a5 -> width=0x1a (derived from UNINITIALIZED stack) DF2223 BASELINE hostb0 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 FIXED hostb0 LNKCAP rc=-22 dst=0x00000000 WRITTEN-0 (upstream contract) DF2223 FIXED hostb0 pcie_get_width_cap-style consumer: lnkcap=0x00000000 -> width=0xff (deterministic UNKNOWN) DF2223 FIXED hostb0 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 BASELINE isab1 LNKCAP rc=-22 dst=0xa5a5a5a5 UNTOUCHED-CANARY (dst left uninitialized) DF2223 BASELINE isab1 pcie_get_width_cap-style consumer: lnkcap=0xa5a5a5a5 -> width=0x1a (derived from UNINITIALIZED stack) DF2223 BASELINE isab1 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 FIXED isab1 LNKCAP rc=-22 dst=0x00000000 WRITTEN-0 (upstream contract) DF2223 FIXED isab1 pcie_get_width_cap-style consumer: lnkcap=0x00000000 -> width=0xff (deterministic UNKNOWN) DF2223 FIXED isab1 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 BASELINE atapci0 LNKCAP rc=-22 dst=0xa5a5a5a5 UNTOUCHED-CANARY (dst left uninitialized) DF2223 BASELINE atapci0 pcie_get_width_cap-style consumer: lnkcap=0xa5a5a5a5 -> width=0x1a (derived from UNINITIALIZED stack) DF2223 BASELINE atapci0 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 FIXED atapci0 LNKCAP rc=-22 dst=0x00000000 WRITTEN-0 (upstream contract) DF2223 FIXED atapci0 pcie_get_width_cap-style consumer: lnkcap=0x00000000 -> width=0xff (deterministic UNKNOWN) DF2223 FIXED atapci0 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 BASELINE (null) LNKCAP rc=-22 dst=0xa5a5a5a5 UNTOUCHED-CANARY (dst left uninitialized) DF2223 BASELINE (null) pcie_get_width_cap-style consumer: lnkcap=0xa5a5a5a5 -> width=0x1a (derived from UNINITIALIZED stack) DF2223 BASELINE (null) CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 FIXED (null) LNKCAP rc=-22 dst=0x00000000 WRITTEN-0 (upstream contract) DF2223 FIXED (null) pcie_get_width_cap-style consumer: lnkcap=0x00000000 -> width=0xff (deterministic UNKNOWN) DF2223 FIXED (null) CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 BASELINE vgapci0 LNKCAP rc=-22 dst=0xa5a5a5a5 UNTOUCHED-CANARY (dst left uninitialized) DF2223 BASELINE vgapci0 pcie_get_width_cap-style consumer: lnkcap=0xa5a5a5a5 -> width=0x1a (derived from UNINITIALIZED stack) DF2223 BASELINE vgapci0 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 FIXED vgapci0 LNKCAP rc=-22 dst=0x00000000 WRITTEN-0 (upstream contract) DF2223 FIXED vgapci0 pcie_get_width_cap-style consumer: lnkcap=0x00000000 -> width=0xff (deterministic UNKNOWN) DF2223 FIXED vgapci0 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 BASELINE virtio_pci0 LNKCAP rc=-22 dst=0xa5a5a5a5 UNTOUCHED-CANARY (dst left uninitialized) DF2223 BASELINE virtio_pci0 pcie_get_width_cap-style consumer: lnkcap=0xa5a5a5a5 -> width=0x1a (derived from UNINITIALIZED stack) DF2223 BASELINE virtio_pci0 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 FIXED virtio_pci0 LNKCAP rc=-22 dst=0x00000000 WRITTEN-0 (upstream contract) DF2223 FIXED virtio_pci0 pcie_get_width_cap-style consumer: lnkcap=0x00000000 -> width=0xff (deterministic UNKNOWN) DF2223 FIXED virtio_pci0 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 BASELINE virtio_pci1 LNKCAP rc=-22 dst=0xa5a5a5a5 UNTOUCHED-CANARY (dst left uninitialized) DF2223 BASELINE virtio_pci1 pcie_get_width_cap-style consumer: lnkcap=0xa5a5a5a5 -> width=0x1a (derived from UNINITIALIZED stack) DF2223 BASELINE virtio_pci1 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 FIXED virtio_pci1 LNKCAP rc=-22 dst=0x00000000 WRITTEN-0 (upstream contract) DF2223 FIXED virtio_pci1 pcie_get_width_cap-style consumer: lnkcap=0x00000000 -> width=0xff (deterministic UNKNOWN) DF2223 FIXED virtio_pci1 CONTROL FLAGS_TYPE rc=-22 dst=0xa5a5a5a5 (no write?) DF2223 VERDICT: 7 devices exercised; baseline left *dst untouched (canary intact) on every not-implemented read while FIXED zeroes it (upstream Linux contract: *val = 0) DF22X ---- DF2224 start: verbatim seq_printf (linux_printf.c:31-39) vs fix-2224 (kvsnprintf) with identical variadic args DF2224 BASELINE [int fmt %d/%lu/%x (want 111/222222/beef)] buf=[376288848/48879/5f5e100] canaries=INTACT first16=3337363238383834382f34383837392f DF2224 FIXED [int fmt %d/%lu/%x (want 111/222222/beef)] buf=[111/222222/beef] canaries=INTACT first16=3131312f3232323232322f6265656600 DF2224 BASELINE [%%p of 0xdeadbeef (leak flavor)] buf=[ptr=0xfffff801166db650] canaries=INTACT first16=7074723d307866666666663830313136 DF2224 FIXED [%%p of 0xdeadbeef] buf=[ptr=0xdeadbeef] canaries=INTACT first16=7074723d3078646561646265656600cc DF2224 witness: rig kernel stack address for comparison: 0xfffff801166db6ec (baseline buf above should hold an address of this shape, not 0xdeadbeef) DF2224 BASELINE [%s of hi] buf=[s=[^P]] canaries=INTACT first16=733d5b105d00cccccccccccccccccccc DF2224 FIXED [%s of hi] buf=[s=[hi]] canaries=INTACT first16=733d5b68695d00cccccccccccccccccc DF2224 VERDICT: baseline garbles every conversion and can print a kernel stack address (%p) into the seq buffer; fixed forwards the real arguments; canaries prove no overflow DF22X RIG done ==========================================