DragonFlyBSD Kernel Audit
DF-2695 / fix_run.log
← back to finding ↓ download raw
== DF-2695 fix validation (patched kernel #1, unprivileged maxx) ==

$ ./poc_sendfile
== DF-2695: sendfile() uninitialized kernel stack leak ==
bad socket fd (-1)           ret=-1  errno=9   (Bad file descriptor) leaked sbytes=0x0000000000000000 (0)
udp socket (EINVAL)          ret=-1  errno=22  (Invalid argument) leaked sbytes=0x0000000000000000 (0)
tcp unconnected (ENOTCONN)   ret=-1  errno=57  (Socket is not connected) leaked sbytes=0x0000000000000000 (0)
negative offset (EINVAL)     ret=-1  errno=57  (Socket is not connected) leaked sbytes=0x0000000000000000 (0)
udp + negative off           ret=-1  errno=22  (Invalid argument) leaked sbytes=0x0000000000000000 (0)
-- 10 samples of the holdsock-error path --  (all 0x0000000000000000)

$ ./leak3
open+sendfile    leaked sbytes=0x0000000000000000
open+sendfile    leaked sbytes=0x0000000000000000
sock+sendfile  leaked sbytes=0x0000000000000000     <-- baseline: 0xfffff80117c88a40 (stable KVA)
sock+sendfile  leaked sbytes=0x0000000000000000     (6 samples, all zero)

Baseline (stock kernel #0): run.log - stable kernel virtual address leak.