⬢ DragonFlyBSD Kernel Audit
DF-3591 / run.log
← back to finding ↓ download raw
--- run 1 baseline ---
== DF-3591 si_init_microcode() err-clobber (CHIP_TAHITI, all-legacy, truncated ME fw) ==
si_cp: Bogus length 1024 in firmware "radeonkmsfw_TAHITI_me"
  [err clobbered: -EINVAL -> 0 by ce request_firmware success]
si_init_microcode -> err=0 (ACCEPTED), me_fw=1024 B (required 8576 B), new_fw=0
running si_cp_load_microcode legacy ME loop (guard page after 1024-byte buffer)...
  SIGSEGV at 0x800474000 on ME loader iteration i=256: read crossed datasize=1024 into the guard page
  OOB READ PROVEN: SI_PM4_UCODE_SIZE=2144 dwords required, buffer holds 256 dwords -> 7552 bytes past allocation
exit=42
--- run 2 baseline ---
== DF-3591 si_init_microcode() err-clobber (CHIP_TAHITI, all-legacy, truncated ME fw) ==
si_cp: Bogus length 1024 in firmware "radeonkmsfw_TAHITI_me"
  [err clobbered: -EINVAL -> 0 by ce request_firmware success]
si_init_microcode -> err=0 (ACCEPTED), me_fw=1024 B (required 8576 B), new_fw=0
running si_cp_load_microcode legacy ME loop (guard page after 1024-byte buffer)...
  SIGSEGV at 0x800474000 on ME loader iteration i=256: read crossed datasize=1024 into the guard page
  OOB READ PROVEN: SI_PM4_UCODE_SIZE=2144 dwords required, buffer holds 256 dwords -> 7552 bytes past allocation
exit=42
--- run 3 baseline ---
== DF-3591 si_init_microcode() err-clobber (CHIP_TAHITI, all-legacy, truncated ME fw) ==
si_cp: Bogus length 1024 in firmware "radeonkmsfw_TAHITI_me"
  [err clobbered: -EINVAL -> 0 by ce request_firmware success]
si_init_microcode -> err=0 (ACCEPTED), me_fw=1024 B (required 8576 B), new_fw=0
running si_cp_load_microcode legacy ME loop (guard page after 1024-byte buffer)...
  SIGSEGV at 0x800474000 on ME loader iteration i=256: read crossed datasize=1024 into the guard page
  OOB READ PROVEN: SI_PM4_UCODE_SIZE=2144 dwords required, buffer holds 256 dwords -> 7552 bytes past allocation
exit=42