⬢ DragonFlyBSD Kernel Audit
DF-2247 / run.log
← back to finding ↓ download raw
== STOCK T1 (datalen=0 -> cp_data NULL) ==
dfh: DF2247: TRIGGER NULL d_table (datalen 0 pair); conv byte 'B' -> d_table[0x42] on NULL
Fatal user address access from kernel mode from sysctl at ffffffff809da50e


Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0x42
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff809da50e
stack pointer	        = 0x10:0xfffff801181b3480
frame pointer	        = 0x10:0xfffff801181b3498
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 823
current thread          = pri 6
kernel: type 12 trap, code=0

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      iconv_xlat_conv+0x5e:   movzbl  (%r10,%r9,1),%r9d

== STOCK T2 (64-byte table, 256-byte sweep) ==
dfh: DF2247 leak sample [256 bytes]: aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 00 00 00 00 00 00 00 00 40 00 40 00 00 00 00 00 38 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 40 60 00 08 00 00 00 00 00 00 00 00 00 00 00 8c 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
dfh: DF2247: 192 of 192 output bytes beyond the 64-byte allocation differ from the fill 0xAA  <<<< OOB-read proof

== controls (256-byte table) ==
dfh: DF2247: mode 0 conv ret=0 consumed=256 produced=256
dfh: DF2247: control output all 0xAA as expected

== FIXED (both T1 and T2) ==
iconv_open FAILED ret=22 (EINVAL) -- guest healthy