⬢ DragonFlyBSD Kernel Audit
DF-2497 / run_test13.log
← back to finding ↓ download raw
== DF-2497 test13: walk stop at the disks[60].sectors stride (PAST the ar_softc allocation) ==
(verbatim baseline run, unfixed kernel, sysctl kern.dfrig3_ata_test=13)
victim rdp=0xfffff8008decf100 size=2424; disks[60].sectors stride at rdp+3016 (600 past the allocation end)
guards 0xfffff8008decfb00..0xfffff8008dec3300 (32 x 2424, uniformly filled with fake-ad-dev pointer)
stride address rdp+3016 = 0xfffff8008decfcc8 outside guards (natural heap decides)
strategy returned 0; dispatches=1
PROOF: walk reached disk index 51 before dispatch (>= 49 means past the 2424-byte allocation): disks[51].sectors is 168 bytes past the object
last_rc=1

serial console (boot.log / dmesg) of the same session:
dfrig3: STRATEGY DISPATCH #1: this(drv)=30 dev=0xffffffff8260b3c0 lba=4010 bytecount=512 flags=912
dfrig3: STRATEGY DISPATCH #1: this(drv)=51 dev=0xffffffff8260b440 lba=4010 bytecount=512 flags=912
(the dispatch itself is production ata_raid_send_request() reaching our interposed
 ata_queue_request with request->this = the OOB drv and request->dev = the OOB-read
 rdp->disks[drv].dev pointer)