DragonFlyBSD Kernel Audit
DF-2798 / run.log
← back to finding ↓ download raw
== T1 (silent full-cover OOB free -> out-of-domain alloc) ==
ALIST representing 100 blocks (0 MB of swap), requiring 17 entries and 1K (136 bytes) of ram
ALIST raw radix tree contains 17 records
    geometry: blocks=100 radix=512 skip=16 rootblks=17
    after free-all: bl_free=100 root bitmap=0000007f
    after alist_free(bl,128,32): bl_free=132 (capacity=100!) root bitmap=0000037f  <-- NO PANIC, bits 8..9 set (child4=11)
    3x alist_alloc(bl,0,32) -> 64 (in-domain exhausted)
    alist_alloc(bl,0,32) returned 128  <-- bl_blocks=100: OUT-OF-DOMAIN block number handed out
    bl_free=4 (restored), root bitmap=00000040
    uninitialized slots 5..16 written: 0 (corruption is logical, in parent meta bits)
== T2 (partial OOB free -> loud panic :784) ==
ALIST representing 100 blocks (0 MB of swap), requiring 17 entries and 1K (136 bytes) of ram
ALIST raw radix tree contains 17 records
    calling alist_free(bl, 120, 4) (partial child beyond limit)...
alst_meta_free: attempt to free block 120 beyond limit of 100

    child exit=1 (1 == panic'ed as expected)