DF-2316 / fix_run.log
================================================================================
DF-2316 FIXED-KERNEL A/B RUN LOG (same PNPH harness kernel, but guest
/usr/src/sys/bus/isa/pnpparse.c patched with fix.diff: 8 per-tag declared-length
guards; sha256 fde2c7e119d2eba1d0427a7a1a559cc07ae6208150a80b43826a38b6190b32a1)
================================================================================
--- PART 1: userland scenario driver (same scenarios, incl. 25)
--- ./pnphctl 9
SC 9 arg=0: rc=0 tag= declared=0 need=0 attrib=0 pass=0 nfields=0 child=
rc=0
--- ./pnphctl 20
pnphctl: ioctl scenario 20: Operation not permitted
rc=1
--- ./pnphctl 21
SC 21 arg=0: rc=0 tag= declared=0 need=0 attrib=0 pass=0 nfields=5 child=
fields: [0]=0/0x1 [1]=0/0x445d5c5b [2]=0/0x528c8486 [3]=0/0x21595241 [4]=0/0x4e414336
chunk1=fffff8011848e800 chunk2=fffff8011848ea00 wrote=0
leakraw: 00000044 00000046 00000032 00000033 00000031 00000036 00000043 00000041
rc=0
--- ./pnphctl 22
SC 22 arg=0: rc=0 tag= declared=0 need=0 attrib=0 pass=0 nfields=0 child=
chunk1=fffff80118497800 chunk2=fffff80118497a00 wrote=0
canary before: cc cc 00 7f cc cc cc cc after: cc cc 00 7f cc cc cc cc
rc=0
--- ./pnphctl 23 1
SC 23 arg=1: rc=0 tag= declared=0 need=0 attrib=0 pass=0 nfields=0 child=(null)
leakraw: 00000011 00000013 00000015 00000017 00000019 0000001b 0000001d 0000001f
rc=0
--- ./pnphctl 23 2
SC 23 arg=2: rc=0 tag= declared=0 need=0 attrib=0 pass=0 nfields=0 child=(null)
chunk1=fffff8008eddc400 chunk2=fffff8008eddc800 wrote=0
leakraw: 00000044 00000032 00000031 00000043 0000004e 00000052 00000021 00000046
rc=0
--- ./pnphctl 23 3
SC 23 arg=3: rc=0 tag= declared=0 need=0 attrib=0 pass=0 nfields=0 child=(null)
leakraw: 000000ff 000000ff 000000ff 00000053 00000044 00000045 00000048 00000041
rc=0
--- ./pnphctl 24
SC 24 arg=0: rc=0 tag= declared=0 need=0 attrib=0 pass=1 nfields=27 child=(null)
fields: [0]=0x44332211/0 [1]=0x1/0 [2]=0xcdef/0 [3]=0x1/0 [4]=0x3b/0 [5]=0x2/0 [6]=0x220/0 [7]=0x23f/0
rc=0
--- ./pnphctl 26
SC 26 arg=0: rc=0 tag= declared=17 need=0 attrib=0 pass=1 nfields=0 child=
rc=0
--- PART 2: kernel-side console lines (fixed kernel)
root@dfbsd:/usr/obj/usr/src/sys/PNPH
PNPHARNESS-READY-2316: pnpparse.c verbatim (TU-compiled) isa0=0xfffff8008bb622a0 /dev/pnph0
PNPH layout: sizeof(isa_config)=960 ic_mem=0 ic_port=128 ic_irqmask=928 ic_drqmask=936 ic_nmem=944
PNPH layout: fixed-offset handlers (tag, bytes dereferenced): COMPAT 4 @0, IRQ 2 @0, DMA 1 @0, IO_RANGE 7 @1..6, IO_FIXED 3 @0..2, MEM_RANGE 9 @1..8, MEM32_RANGE 17 @1..16, MEM32_FIXED 9 @1..8
PNPH sweep COMPAT_DEVICE declen=0 need=4: TRUNCATED -- 4 bytes read past a len-0 descriptor (offsets 0..3) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x4030201 MISMATCH
PNPH sweep COMPAT_DEVICE declen=4 need=4: control attrib=PASS
PNPH sweep f[0]= 0x4030201 expect= 0x4030201
PNPH sweep IRQ_FORMAT declen=0 need=2: TRUNCATED -- 2 bytes read past a len-0 descriptor (offsets 0..1) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x201 MISMATCH
PNPH sweep IRQ_FORMAT declen=2 need=2: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x201 expect= 0x201
PNPH sweep DMA_FORMAT declen=0 need=1: TRUNCATED -- 1 bytes read past a len-0 descriptor (offsets 0..0) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x1 MISMATCH
PNPH sweep DMA_FORMAT declen=1 need=1: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x1 expect= 0x1
PNPH sweep IO_RANGE declen=0 need=7: TRUNCATED -- 7 bytes read past a len-0 descriptor (offsets 0..6) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x302 MISMATCH
PNPH sweep f[2]= 0 expect= 0x50a MISMATCH
PNPH sweep f[3]= 0 expect= 0x7 MISMATCH
PNPH sweep f[4]= 0 expect= 0x6 MISMATCH
PNPH sweep IO_RANGE declen=7 need=7: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x302 expect= 0x302
PNPH sweep f[2]= 0x50a expect= 0x50a
PNPH sweep f[3]= 0x7 expect= 0x7
PNPH sweep f[4]= 0x6 expect= 0x6
PNPH sweep IO_FIXED declen=0 need=3: TRUNCATED -- 3 bytes read past a len-0 descriptor (offsets 0..2) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x201 MISMATCH
PNPH sweep f[2]= 0 expect= 0x203 MISMATCH
PNPH sweep f[3]= 0 expect= 0x3 MISMATCH
PNPH sweep f[4]= 0 expect= 0x1 MISMATCH
PNPH sweep IO_FIXED declen=3 need=3: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x201 expect= 0x201
PNPH sweep f[2]= 0x203 expect= 0x203
PNPH sweep f[3]= 0x3 expect= 0x3
PNPH sweep f[4]= 0x1 expect= 0x1
PNPH sweep MEM_RANGE declen=0 need=9: TRUNCATED -- 9 bytes read past a len-0 descriptor (offsets 0..8) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x30200 MISMATCH
PNPH sweep f[2]= 0 expect= 0xe0bff MISMATCH
PNPH sweep f[3]= 0 expect= 0x90800 MISMATCH
PNPH sweep f[4]= 0 expect= 0x706 MISMATCH
PNPH sweep MEM_RANGE declen=9 need=9: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x30200 expect= 0x30200
PNPH sweep f[2]= 0xe0bff expect= 0xe0bff
PNPH sweep f[3]= 0x90800 expect= 0x90800
PNPH sweep f[4]= 0x706 expect= 0x706
PNPH sweep MEM32_RANGE declen=0 need=17: TRUNCATED -- 17 bytes read past a len-0 descriptor (offsets 0..16) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x5040302 MISMATCH
PNPH sweep f[2]= 0 expect=0x1a181613 MISMATCH
PNPH sweep f[3]= 0 expect=0x11100f0e MISMATCH
PNPH sweep f[4]= 0 expect= 0xd0c0b0a MISMATCH
PNPH sweep MEM32_RANGE declen=17 need=17: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]=0x1a181613 expect=0x1a181613
PNPH sweep f[3]=0x11100f0e expect=0x11100f0e
PNPH sweep f[4]= 0xd0c0b0a expect= 0xd0c0b0a
PNPH sweep MEM32_FIXED declen=0 need=9: TRUNCATED -- 9 bytes read past a len-0 descriptor (offsets 0..8) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x5040302 MISMATCH
PNPH sweep f[2]= 0 expect= 0xe0c0a07 MISMATCH
PNPH sweep f[3]= 0 expect= 0x9080706 MISMATCH
PNPH sweep f[4]= 0 expect= 0x1 MISMATCH
PNPH sweep MEM32_FIXED declen=9 need=9: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]= 0xe0c0a07 expect= 0xe0c0a07
PNPH sweep f[3]= 0x9080706 expect= 0x9080706
PNPH sweep f[4]= 0x1 expect= 0x1
PNPH sweep MEM32_RANGE declen=16 need=17: 1 byte (offset +16) past the descriptor attrib=FAIL
PNPH sweep: worst case = 17 bytes (MEMORY32_RANGE, pnpparse.c:278-299)
PNPH layout: sizeof(isa_config)=960 ic_mem=0 ic_port=128 ic_irqmask=928 ic_drqmask=936 ic_nmem=944
PNPH layout: fixed-offset handlers (tag, bytes dereferenced): COMPAT 4 @0, IRQ 2 @0, DMA 1 @0, IO_RANGE 7 @1..6, IO_FIXED 3 @0..2, MEM_RANGE 9 @1..8, MEM32_RANGE 17 @1..16, MEM32_FIXED 9 @1..8
PNPH sweep COMPAT_DEVICE declen=0 need=4: TRUNCATED -- 4 bytes read past a len-0 descriptor (offsets 0..3) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x4030201 MISMATCH
PNPH sweep COMPAT_DEVICE declen=4 need=4: control attrib=PASS
PNPH sweep f[0]= 0x4030201 expect= 0x4030201
PNPH sweep IRQ_FORMAT declen=0 need=2: TRUNCATED -- 2 bytes read past a len-0 descriptor (offsets 0..1) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x201 MISMATCH
PNPH sweep IRQ_FORMAT declen=2 need=2: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x201 expect= 0x201
PNPH sweep DMA_FORMAT declen=0 need=1: TRUNCATED -- 1 bytes read past a len-0 descriptor (offsets 0..0) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x1 MISMATCH
PNPH sweep DMA_FORMAT declen=1 need=1: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x1 expect= 0x1
PNPH sweep IO_RANGE declen=0 need=7: TRUNCATED -- 7 bytes read past a len-0 descriptor (offsets 0..6) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x302 MISMATCH
PNPH sweep f[2]= 0 expect= 0x50a MISMATCH
PNPH sweep f[3]= 0 expect= 0x7 MISMATCH
PNPH sweep f[4]= 0 expect= 0x6 MISMATCH
PNPH sweep IO_RANGE declen=7 need=7: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x302 expect= 0x302
PNPH sweep f[2]= 0x50a expect= 0x50a
PNPH sweep f[3]= 0x7 expect= 0x7
PNPH sweep f[4]= 0x6 expect= 0x6
PNPH sweep IO_FIXED declen=0 need=3: TRUNCATED -- 3 bytes read past a len-0 descriptor (offsets 0..2) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x201 MISMATCH
PNPH sweep f[2]= 0 expect= 0x203 MISMATCH
PNPH sweep f[3]= 0 expect= 0x3 MISMATCH
PNPH sweep f[4]= 0 expect= 0x1 MISMATCH
PNPH sweep IO_FIXED declen=3 need=3: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x201 expect= 0x201
PNPH sweep f[2]= 0x203 expect= 0x203
PNPH sweep f[3]= 0x3 expect= 0x3
PNPH sweep f[4]= 0x1 expect= 0x1
PNPH sweep MEM_RANGE declen=0 need=9: TRUNCATED -- 9 bytes read past a len-0 descriptor (offsets 0..8) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x30200 MISMATCH
PNPH sweep f[2]= 0 expect= 0xe0bff MISMATCH
PNPH sweep f[3]= 0 expect= 0x90800 MISMATCH
PNPH sweep f[4]= 0 expect= 0x706 MISMATCH
PNPH sweep MEM_RANGE declen=9 need=9: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x30200 expect= 0x30200
PNPH sweep f[2]= 0xe0bff expect= 0xe0bff
PNPH sweep f[3]= 0x90800 expect= 0x90800
PNPH sweep f[4]= 0x706 expect= 0x706
PNPH sweep MEM32_RANGE declen=0 need=17: TRUNCATED -- 17 bytes read past a len-0 descriptor (offsets 0..16) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x5040302 MISMATCH
PNPH sweep f[2]= 0 expect=0x1a181613 MISMATCH
PNPH sweep f[3]= 0 expect=0x11100f0e MISMATCH
PNPH sweep f[4]= 0 expect= 0xd0c0b0a MISMATCH
PNPH sweep MEM32_RANGE declen=17 need=17: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]=0x1a181613 expect=0x1a181613
PNPH sweep f[3]=0x11100f0e expect=0x11100f0e
PNPH sweep f[4]= 0xd0c0b0a expect= 0xd0c0b0a
PNPH sweep MEM32_FIXED declen=0 need=9: TRUNCATED -- 9 bytes read past a len-0 descriptor (offsets 0..8) attrib=FAIL
PNPH sweep f[0]= 0 expect= 0x1 MISMATCH
PNPH sweep f[1]= 0 expect= 0x5040302 MISMATCH
PNPH sweep f[2]= 0 expect= 0xe0c0a07 MISMATCH
PNPH sweep f[3]= 0 expect= 0x9080706 MISMATCH
PNPH sweep f[4]= 0 expect= 0x1 MISMATCH
PNPH sweep MEM32_FIXED declen=9 need=9: control attrib=PASS
PNPH sweep f[0]= 0x1 expect= 0x1
PNPH sweep f[1]= 0x5040302 expect= 0x5040302
PNPH sweep f[2]= 0xe0c0a07 expect= 0xe0c0a07
PNPH sweep f[3]= 0x9080706 expect= 0x9080706
PNPH sweep f[4]= 0x1 expect= 0x1
PNPH sweep MEM32_RANGE declen=16 need=17: 1 byte (offset +16) past the descriptor attrib=FAIL
PNPH sweep: worst case = 17 bytes (MEMORY32_RANGE, pnpparse.c:278-299)
PNPH canrd[0]: c1=0xfffff8011848e800 c2=0xfffff8011848ea00 res=0xfffff8011848e9fc res+13=0xfffff8011848ea09 (c2+9)
PNPH canrd[0]: ir_size=0 == I32(c2+9)=0x21595241 ir_align=0 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak)
PNPH canrd f[0]= 0 expect= 0x1 MISMATCH
PNPH canrd f[1]= 0 expect=0x445d5c5b MISMATCH
PNPH canrd f[2]= 0 expect=0x528c8486 MISMATCH
PNPH canrd f[3]= 0 expect=0x21595241 MISMATCH
PNPH canrd f[4]= 0 expect=0x4e414336 MISMATCH
PNPH canrd[1]: c1=0xfffff80118491800 c2=0xfffff80118491a00 res=0xfffff801184919fc res+13=0xfffff80118491a09 (c2+9)
PNPH canrd[1]: ir_size=0 == I32(c2+9)=0x21595241 ir_align=0 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak)
PNPH canrd f[0]= 0 expect= 0x1 MISMATCH
PNPH canrd f[1]= 0 expect=0x445d5c5b MISMATCH
PNPH canrd f[2]= 0 expect=0x528c8486 MISMATCH
PNPH canrd f[3]= 0 expect=0x21595241 MISMATCH
PNPH canrd f[4]= 0 expect=0x4e414336 MISMATCH
PNPH canrd[2]: c1=0xfffff80118494800 c2=0xfffff80118494a00 res=0xfffff801184949fc res+13=0xfffff80118494a09 (c2+9)
PNPH canrd[2]: ir_size=0 == I32(c2+9)=0x21595241 ir_align=0 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak)
PNPH canrd f[0]= 0 expect= 0x1 MISMATCH
PNPH canrd f[1]= 0 expect=0x445d5c5b MISMATCH
PNPH canrd f[2]= 0 expect=0x528c8486 MISMATCH
PNPH canrd f[3]= 0 expect=0x21595241 MISMATCH
PNPH canrd f[4]= 0 expect=0x4e414336 MISMATCH
PNPH canwr: c1=0xfffff80118497800 c2=0xfffff80118497a00 res=0xfffff801184979fd res+5=0xfffff80118497a02 (c2+2) res+6=0xfffff80118497a03 (c2+3)
PNPH canwr: c2[0..7] before: cc cc 00 7f cc cc cc cc
PNPH canwr: c2[0..7] after: cc cc 00 7f cc cc cc cc
PNPH canwr: canary byte c2[2] (res+5, 2 bytes past the chunk) 0x00 -> 0 : not written (pnpparse.c:163-166 res[5]=1)
PNPH e2e1: buf=0xfffff8008eddbc00 logical len=3, payload markers at [3..1024)
PNPH e2e1: stored config:
PNPH e2e1: nmem=0 nport=0 nirq=0 ndrq=0
PNPH e2e1: ir_size=0 == I32(buf+16)=0x14131211 (markers past the logical stream end)
PNPH e2e2: c1=0xfffff8008eddc400 c2=0xfffff8008eddc800; tag+len bytes at c1[1021..1023], res=c1+1024=c2 -> reads c2[0..16], ALL past the 1024B allocation
PNPH e2e2: stored config:
PNPH e2e2: nmem=0 nport=0 nirq=0 ndrq=0
PNPH e2e2: ir_size=0 == I32(c2+13)=0x33324644 -> 17 canary bytes read past the allocation through the REAL parse entry
PNPH e2e3: groom=0xfffff8008dcd6800 stream=0xfffff8008dcd6800 same=1 (uninitialized heap residue visible past the descriptor)
PNPH e2e3: residue bytes st[3..19]: ff ff ff ff ff 45 53 49 44 55 45 2d 48 45 41 50 44 <.....ESIDUE-HEAPD>
PNPH e2e3: stored config:
PNPH e2e3: nmem=0 nport=0 nirq=0 ndrq=0
PNPH e2e3: ir_size=0 == I32(st+16)=0x44504145 -> kernel heap residue flowed into the device resource config (devinfo/bootverbose visible)
PNPH well: child=(null) compatid=0x44332211 have=1 nmem=3 nport=2 nirq=1 ndrq=1
PNPH well: nmem=3 nport=2 nirq=1 ndrq=1
PNPH well: mem[0] start=0x100000 end=0x20ffff size=0x10000 align=0x1000
PNPH well: mem[1] start=0x10000000 end=0x2fffffff size=0x10000000 align=0x4000000
PNPH well: mem[2] start=0x20000000 end=0x2fffffff size=0x10000000 align=0x1
PNPH well: port[0] start=0x220 end=0x23f size=0x10 align=0x10
PNPH well: port[1] start=0x2f8 end=0x2ff size=0x8 align=0x1
PNPH well: irq[0]=0xcdef
PNPH well: drq[0]=0x3b
PNPH well: field vector (A/B reference):
PNPH well field[ 0]=0x44332211
PNPH well field[ 1]= 0x1
PNPH well field[ 2]= 0xcdef
PNPH well field[ 3]= 0x1
PNPH well field[ 4]= 0x3b
PNPH well field[ 5]= 0x2
PNPH well field[ 6]= 0x220
PNPH well field[ 7]= 0x23f
PNPH well field[ 8]= 0x10
PNPH well field[ 9]= 0x10
PNPH well field[10]= 0x2f8
PNPH well field[11]= 0x2ff
PNPH well field[12]= 0x8
PNPH well field[13]= 0x1
PNPH well field[14]= 0x3
PNPH well field[15]= 0x100000
PNPH well field[16]= 0x20ffff
PNPH well field[17]= 0x10000
PNPH well field[18]= 0x1000
PNPH well field[19]=0x10000000
PNPH well field[20]=0x2fffffff
PNPH well field[21]=0x10000000
PNPH well field[22]= 0x4000000
PNPH well field[23]=0x20000000
PNPH well field[24]=0x2fffffff
PNPH well field[25]=0x10000000
PNPH well field[26]= 0x1
PNPH pg: base=0xfffff80118444000 page1end=0xfffff80118445000 res=0xfffff80118444fef res+13=0xfffff80118444ffc (page2 VA range freed: [0xfffff80118445000,0xfffff80118447000) unmapped)
PNPH pgctl: full len-17 descriptor parsed rc=0 nmem=1 ir_size=0x11100f0e==I32(res+13)=0x11100f0e attrib=PASS (all reads inside page 1)
PNPH pg: base=0xfffff80118459000 page1end=0xfffff8011845a000 res=0xfffff80118459ff3 res+13=0xfffff8011845a000 (page2 VA range freed: [0xfffff8011845a000,0xfffff8011845c000) unmapped)
PNPH pgflt: calling pnp_parse_desc(tag=0x85 MEMORY32_RANGE, res, len=0) -- expect fatal page fault at va=0xfffff8011845a000 (= res+13, first OOB byte)
PNPH pgflt: UNEXPECTED no-fault rc=0 (fixed kernel?)
--- PART 3: scenario 25 on the FIXED kernel (no panic, guard fired)