⬢ DragonFlyBSD Kernel Audit
DF-3615 / offmod.c
← back to finding ↓ download raw
/* offmod.c - KLD that prints ath_softc field offsets from inside the real
 * kernel build environment. Used to measure the corruption geometry of the
 * unvalidated ts_antenna index in ath_tx_update_stats() (if_ath.c:4197-4199).
 *
 * Build:  see build.sh (make -DNO_WERROR against X86_64_GENERIC obj tree)
 * Run:    kldload ./off.ko ; dmesg | grep OFF ; kldunload off
 */
#include "opt_wlan.h"
#include "opt_ah.h"
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/systm.h>
#include <sys/module.h>
#include <sys/mbuf.h>
#include <sys/socket.h>
#include <sys/sockio.h>
#include <net/if.h>
#include <net/if_media.h>
#include <net/route.h>
#include <net/ethernet.h>
#include <netproto/802_11/ieee80211.h>
#include <netproto/802_11/ieee80211_var.h>
#include <dev/netif/ath/ath/if_athvar.h>

static void offprint(void *unused __unused) {
    kprintf("OFF sizeof(ath_softc)=%zu sizeof(ath_stats)=%zu\n",
        sizeof(struct ath_softc), sizeof(struct ath_stats));
#define P(m) kprintf("OFF %-24s=%zu\n", #m, __builtin_offsetof(struct ath_softc, m))
    P(sc_ic); P(sc_stats); P(sc_aggr_stats); P(sc_intr_stats); P(sc_debug);
    P(sc_rx); P(sc_rxedma); P(sc_tx); P(sc_txedma);
    P(sc_txq); P(sc_ac2q); P(sc_txtask); P(sc_wd_timer);
    P(sc_bhalq); P(sc_bmisscount); P(sc_ant_tx); P(sc_cabq);
    P(sc_bmisstask); P(sc_bslot); P(sc_cal_ch); P(sc_halstats);
    P(sc_eepromdata); P(sc_rc);
    kprintf("OFF sc_stats.ast_ant_tx   =%zu\n",
        __builtin_offsetof(struct ath_softc, sc_stats.ast_ant_tx));
    kprintf("OFF reach1 ast_ant_tx+4*255=%zu sc_ant_tx+4*255=%zu\n",
        __builtin_offsetof(struct ath_softc, sc_stats.ast_ant_tx) + 4*255,
        __builtin_offsetof(struct ath_softc, sc_ant_tx) + 4*255);
}
SYSINIT(offprint, SI_SUB_DRIVERS, SI_ORDER_ANY, offprint, NULL);