DF-2224 / run_section.log
DF22X RIG start ========================================= DF22X ---- DF22X ---- DF22X ---- DF2224 start: verbatim seq_printf (linux_printf.c:31-39) vs fix-2224 (kvsnprintf) with identical variadic args DF2224 BASELINE [int fmt %d/%lu/%x (want 111/222222/beef)] buf=[402699856/48879/5f5e100] canaries=INTACT first16=3430323639393835362f34383837392f DF2224 FIXED [int fmt %d/%lu/%x (want 111/222222/beef)] buf=[111/222222/beef] canaries=INTACT first16=3131312f3232323232322f6265656600 DF2224 BASELINE [%%p of 0xdeadbeef (leak flavor)] buf=[ptr=0xfffff8011800b650] canaries=INTACT first16=7074723d307866666666663830313138 DF2224 FIXED [%%p of 0xdeadbeef] buf=[ptr=0xdeadbeef] canaries=INTACT first16=7074723d3078646561646265656600cc DF2224 witness: rig kernel stack address for comparison: 0xfffff8011800b6ec (baseline buf above should hold an address of this shape, not 0xdeadbeef) DF2224 BASELINE [%s of hi] buf=[s=[^P]] canaries=INTACT first16=733d5b105d00cccccccccccccccccccc DF2224 FIXED [%s of hi] buf=[s=[hi]] canaries=INTACT first16=733d5b68695d00cccccccccccccccccc DF2224 VERDICT: baseline garbles every conversion and can print a kernel stack address (%p) into the seq buffer; fixed forwards the real arguments; canaries prove no overflow DF22X RIG done ==========================================