DF-2449 / run.log
[*] DF-2449 dm_table_load_ioctl uninitialized start/length
[*] kmalloc(sizeof(dm_table_entry_t), M_DM, M_WAITOK) -- NO M_ZERO
[*] prop_dictionary_get_uint64 return value NOT checked
[*] running 5 reload cycles, omitting start/length each time...
[trial 0] df2449_0: start=0x0000000000000000 length=0x0000000000000000
[trial 1] df2449_1: start=0xffffffffffffffff length=0xffffffffffffffff
[trial 2] df2449_2: start=0xffffffffffffffff length=0xffffffffffffffff
[trial 3] df2449_3: start=0xffffffffffffffff length=0xffffffffffffffff
[trial 4] df2449_4: start=0xffffffffffffffff length=0xffffffffffffffff
[*] variance over 5 successful reloads: 4/4 differ in start, 4/4 in length
[!!!] UNINITIALIZED-HEAP LEAK CONFIRMED: at least one
trial returned non-zero start/length despite the
reload ioctl OMITTING both keys. The values are
stale slab bytes from kmalloc(sizeof(dm_table_entry_t)).
[!!!] Values VARY across trials -- definitive
evidence of uninitialized heap residue
(a properly-initialized field would be
constant 0/0 across all trials).
[*] Impact: 16 bytes of uninitialized kernel heap
leaked per table entry per status query
(sys/dev/disk/dm/dm_ioctl.c:937-940).
[*] This is CWE-457 / CWE-908 (use of uninitialized
memory / leak) in sys/dev/disk/dm/dm_ioctl.c:743-753.