⬢ DragonFlyBSD Kernel Audit
DF-3953 / run.log
← back to finding ↓ download raw
########## FINAL RUN DF-3953 (analysis)
DF-3953 radeon kv_dpm boot_ps NULL family (simulation)
offsetof(struct radeon_ps, ps_priv)          = 64
kv_get_ps(NULL) reads *(void **)(NULL + 64)
kv_dpm_enable (:1277)  -> kv_update_current_ps(rdev, boot_ps=NULL)
kv_dpm_disable (:1326) -> kv_update_current_ps(rdev, boot_ps=NULL)
kv_dpm_get_sclk (:2881) reads *(kv_ps **)(NULL + 64).levels[0] @ +0
kernel fault address for kv_get_ps(NULL): 0x40 (NULL page, always unmapped)
NON-CRASH MODE: analysis only. Re-run with 'crash' to execute the derefs.
ANALYSIS_EXIT=0
########## FINAL RUN DF-3953 (crash)
DF-3953 radeon kv_dpm boot_ps NULL family (simulation)
offsetof(struct radeon_ps, ps_priv)          = 64
kv_get_ps(NULL) reads *(void **)(NULL + 64)
kv_dpm_enable (:1277)  -> kv_update_current_ps(rdev, boot_ps=NULL)
kv_dpm_disable (:1326) -> kv_update_current_ps(rdev, boot_ps=NULL)
kv_dpm_get_sclk (:2881) reads *(kv_ps **)(NULL + 64).levels[0] @ +0
kernel fault address for kv_get_ps(NULL): 0x40 (NULL page, always unmapped)
child2: executing kv_dpm_get_sclk with requested_rps == NULL ...
DF-3953 radeon kv_dpm boot_ps NULL family (simulation)
offsetof(struct radeon_ps, ps_priv)          = 64
kv_get_ps(NULL) reads *(void **)(NULL + 64)
kv_dpm_enable (:1277)  -> kv_update_current_ps(rdev, boot_ps=NULL)
kv_dpm_disable (:1326) -> kv_update_current_ps(rdev, boot_ps=NULL)
kv_dpm_get_sclk (:2881) reads *(kv_ps **)(NULL + 64).levels[0] @ +0
kernel fault address for kv_get_ps(NULL): 0x40 (NULL page, always unmapped)
child1: executing kv_update_current_ps(boot_ps == NULL) ...
DF-3953 radeon kv_dpm boot_ps NULL family (simulation)
offsetof(struct radeon_ps, ps_priv)          = 64
kv_get_ps(NULL) reads *(void **)(NULL + 64)
kv_dpm_enable (:1277)  -> kv_update_current_ps(rdev, boot_ps=NULL)
kv_dpm_disable (:1326) -> kv_update_current_ps(rdev, boot_ps=NULL)
kv_dpm_get_sclk (:2881) reads *(kv_ps **)(NULL + 64).levels[0] @ +0
kernel fault address for kv_get_ps(NULL): 0x40 (NULL page, always unmapped)
child1 (kv_get_ps(NULL) @ :239-244 via :1277): SIGNALLED sig=11 -> kernel equivalent: page fault on NULL page => panic
child2 (kv_dpm_get_sclk :2881): SIGNALLED sig=11 -> kernel equivalent: page fault on NULL page => panic
RESULT: BOTH SINKS FAULT AS PREDICTED (rc=0)
CRASH_EXIT=0