⬢ DragonFlyBSD Kernel Audit
DF-2351 / panic.txt
← back to finding ↓ download raw
login: RIG2351: === DF-2351: uint16->uint8 truncation of nfmt ===
RIG2351: crafted cdesc len=2869 (256 VS_FORMAT_MJPEG, 0 frames)
RIG2351: production uvc_drv_init_data_fmt ret=0
RIG2351: counted nfmt=256 (uint16_t local) -> stored data->nfmt=0 nfrm=0 nitv=0 fmt=0xfffff80118496000  <-- TRUNCATION if nfmt==0
RIG2351: production uvc_drv_parse_data ret=0 (data->nfmt=0)
RIG2351: entering production uvc_drv_init_cur_fmt_frm with data->nfmt==0 -- search loop is skipped, fmt stays NULL, fmt->nfrm dereferences NULL (uvc_drv.c:1463). Expect panic.
Fatal user address access from kernel mode from sysctl at ffffffff82618d73


Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0x8
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff82618d73
stack pointer	        = 0x10:0xfffff80117cd76e0
frame pointer	        = 0x10:0xfffff80117cd7798
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1026
current thread          = pri 6 
kernel: type 12 trap, code=0

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      uvc_drv_init_cur_fmt_frm.cold.36:       movq    0x8,%rax
db>