⬢ DragonFlyBSD Kernel Audit
DF-2285 / run.log
← back to finding ↓ download raw 
interrupt uses mplock: psm0
psm0: model IntelliMouse Explorer, device ID 4
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 on acpi0
sio0: type 16550A, console
ACPI: Enabled 2 GPEs in block 00 to 0F
rdrand0: No RdRand support.
orm0: <ISA Option ROM> at iomem 0xe8000-0xeffff on isa1
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa1
sio2: can't drain, serial port might not exist, disabling
hpt27xx: no controller detected.
CAM: Configuring 2 busses
CAM: finished configuring all busses
DFH: xpt_register_async(0x60) swallowed by harness (driver inert at boot)
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device 
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=0 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fae0000 pmp=0xfffff80090280000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
DFH: sim: XPT_EN_LUN enable=1
DFH: ctor: targbhctor -> 0x1; softc=0xfffff80117b9c980 size=280 sizeof(targbh_softc)=280 state_off=248 pending_off=0 work_off=16
DFH: ctor: fake SIM pools: atio=8 in=8
DFH: dtor thread: calling targbhdtor (ticks=4491)
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d23c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d20c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d1dc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d1ac0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d17c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d14c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d11c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d0ec0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT IN 0xfffff801183d3bc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d38c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d35c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d32c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d2fc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d2cc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d29c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d26c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_EN_LUN enable=0
DFH: kfree(softc=0xfffff80117b9c980 size=280) (CTIO still not held)
DFH: dtor thread: targbhdtor RETURNED after 66 ticks (hz/2=50); softc_freed=1
DFH: reclaim: canary victim 0xfffff80117b9c980 (0x41-filled, size 280) == freed softc chunk (SAME CHUNK reclaimed)
DFH: dtorwait: 1
DFH: dump[cmd] chunk=0xfffff80117b9c980 size=280 (canary fill 0x41)
DFH:   +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[cmd] damaged_qwords(out of 35)=0
DFH: dump[cmd] victim=0xfffff80117b9c980 (was softc) pending_queue.tqh_first=0x4141414141414141 (0x41 canary intact unless TAILQ_REMOVE wrote after free; NULL write expected on UAF)
DFH: dump[cmd] pending_queue.tqh_last=0x4141414141414141 (self-pointer softc+0 written by TAILQ_REMOVE on UAF)
DFH: dump[victim] chunk=0xfffff80117b9c980 size=280 (canary fill 0x41)
DFH:   +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[victim] damaged_qwords(out of 35)=0
Freed an immediate notify
DFH: sim: XPT_EN_LUN enable=0
DFH: kfree(softc=0xfffff80117b9c980 size=280) (CTIO still not held)
DFH: dtor thread: targbhdtor RETURNED after 66 ticks (hz/2=50); softc_freed=1
DFH: reclaim: canary victim 0xfffff80117b9c980 (0x41-filled, size 280) == freed softc chunk (SAME CHUNK reclaimed)
DFH: dtorwait: 1
DFH: dump[cmd] chunk=0xfffff80117b9c980 size=280 (canary fill 0x41)
DFH:   +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[cmd] damaged_qwords(out of 35)=0
DFH: dump[cmd] victim=0xfffff80117b9c980 (was softc) pending_queue.tqh_first=0x4141414141414141 (0x41 canary intact unless TAILQ_REMOVE wrote after free; NULL write expected on UAF)
DFH: dump[cmd] pending_queue.tqh_last=0x4141414141414141 (self-pointer softc+0 written by TAILQ_REMOVE on UAF)
DFH: dump[victim] chunk=0xfffff80117b9c980 size=280 (canary fill 0x41)
DFH:   +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[victim] damaged_qwords(out of 35)=0
DFH: sim: XPT_EN_LUN enable=1
DFH: ctor: targbhctor -> 0x1; softc=0xfffff80117b9caa0 size=280 sizeof(targbh_softc)=280 state_off=248 pending_off=0 work_off=16
DFH: ctor: fake SIM pools: atio=8 in=8
DFH: inquiry: initiator 7 selects LUN, ATIO 0xfffff801183d3ec0 completed to periph with INQUIRY CDB
DFH: xpt schedules targbhstart (priority 1)
DFH: sim: CTIO 0xfffff8008db00cc0 ACCEPTED AND HELD at fake SIM (stalled initiator; ticks=5094)
DFH: complete: firing held CTIO 0xfffff8008db00cc0 into targbhdone (outstanding 127 ticks, hz/2=50) softc_freed=0
DFH: complete: targbhdone returned; postfree_actions=0 rearm_after_free=0
DFH: dtor thread: calling targbhdtor (ticks=5352)
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d38c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d35c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d32c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d2fc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d2cc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d29c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d26c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff801183d3ec0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT IN 0xfffff801183d20c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d1dc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d1ac0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d17c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d14c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d11c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d0ec0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff801183d3bc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_EN_LUN enable=0
DFH: kfree(softc=0xfffff80117b9caa0 size=280) (CTIO still not held)
DFH: dtor thread: targbhdtor RETURNED after 65 ticks (hz/2=50); softc_freed=1
DFH: reclaim: canary victim 0xfffff80117b9caa0 (0x41-filled, size 280) == freed softc chunk (SAME CHUNK reclaimed)
DFH: dtorwait: 1
DFH: dump[cmd] chunk=0xfffff80117b9caa0 size=280 (canary fill 0x41)
DFH:   +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[cmd] damaged_qwords(out of 35)=0
DFH: dump[cmd] victim=0xfffff80117b9caa0 (was softc) pending_queue.tqh_first=0x4141414141414141 (0x41 canary intact unless TAILQ_REMOVE wrote after free; NULL write expected on UAF)
DFH: dump[cmd] pending_queue.tqh_last=0x4141414141414141 (self-pointer softc+0 written by TAILQ_REMOVE on UAF)
DFH: dump[victim] chunk=0xfffff80117b9caa0 size=280 (canary fill 0x41)
DFH:   +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[victim] damaged_qwords(out of 35)=0
DFH: sim: XPT_ABORT IN 0xfffff801183d3bc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_EN_LUN enable=0
DFH: kfree(softc=0xfffff80117b9caa0 size=280) (CTIO still not held)
DFH: dtor thread: targbhdtor RETURNED after 65 ticks (hz/2=50); softc_freed=1
DFH: reclaim: canary victim 0xfffff80117b9caa0 (0x41-filled, size 280) == freed softc chunk (SAME CHUNK reclaimed)
DFH: dtorwait: 1
DFH: dump[cmd] chunk=0xfffff80117b9caa0 size=280 (canary fill 0x41)
DFH:   +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[cmd] damaged_qwords(out of 35)=0
DFH: dump[cmd] victim=0xfffff80117b9caa0 (was softc) pending_queue.tqh_first=0x4141414141414141 (0x41 canary intact unless TAILQ_REMOVE wrote after free; NULL write expected on UAF)
DFH: dump[cmd] pending_queue.tqh_last=0x4141414141414141 (self-pointer softc+0 written by TAILQ_REMOVE on UAF)
DFH: dump[victim] chunk=0xfffff80117b9caa0 size=280 (canary fill 0x41)
DFH:   +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[victim] damaged_qwords(out of 35)=0
DFH: sim: XPT_EN_LUN enable=1
DFH: ctor: targbhctor -> 0x1; softc=0xfffff8004f296c20 size=280 sizeof(targbh_softc)=280 state_off=248 pending_off=0 work_off=16
DFH: ctor: fake SIM pools: atio=8 in=8
DFH: inquiry: initiator 7 selects LUN, ATIO 0xfffff8008db00cc0 completed to periph with INQUIRY CDB
DFH: xpt schedules targbhstart (priority 1)
DFH: sim: CTIO 0xfffff801183d23c0 ACCEPTED AND HELD at fake SIM (stalled initiator; ticks=5923)
DFH: dtor thread: calling targbhdtor (ticks=6050)
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1cbc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db003c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1fbc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1f8c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1ddc0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1dac0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT idle ATIO 0xfffff8008db1d7c0 -> completed CAM_REQ_ABORTED
DFH: sim: XPT_ABORT SELECTED ATIO 0xfffff8008db00cc0 -> CAM_REQ_CMP_ERR (SIM cannot abort a ccb owned by the periph; in-flight CTIO untracked)
DFH: sim: XPT_ABORT IN 0xfffff8008db02ac0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db027c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db024c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db021c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db01ec0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db01bc0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db1d4c0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_ABORT IN 0xfffff8008db1cec0 -> completed CAM_REQ_ABORTED
Freed an immediate notify
DFH: sim: XPT_EN_LUN enable=0
DFH: kfree(softc=0xfffff8004f296c20 size=280) (CTIO still HELD at fake SIM)
DFH: dtor thread: targbhdtor RETURNED after 65 ticks (hz/2=50); softc_freed=1
DFH: reclaim: canary victim 0xfffff8004f296c20 (0x41-filled, size 280) == freed softc chunk (SAME CHUNK reclaimed)
DFH: dtorwait: 1
DFH: dump[cmd] chunk=0xfffff8004f296c20 size=280 (canary fill 0x41)
DFH:   +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[cmd] damaged_qwords(out of 35)=0
DFH: dump[cmd] victim=0xfffff8004f296c20 (was softc) pending_queue.tqh_first=0x4141414141414141 (0x41 canary intact unless TAILQ_REMOVE wrote after free; NULL write expected on UAF)
DFH: dump[cmd] pending_queue.tqh_last=0x4141414141414141 (self-pointer softc+0 written by TAILQ_REMOVE on UAF)
DFH: dump[victim] chunk=0xfffff8004f296c20 size=280 (canary fill 0x41)
DFH:   +00: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +16: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +32: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +48: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +64: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH:   +80: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
DFH: dump[victim] damaged_qwords(out of 35)=0
DFH: status: ctor=1 dtor_started=1 dtor_done=1 dtor_ticks=65 ctio_held=1 softc=0xfffff8004f296c20 freed=1 postfree=0 rearm=0 periph_poisoned=0 victim=1 abortmode=1