⬢ DragonFlyBSD Kernel Audit
DF-3954 / run.log
← back to finding ↓ download raw
########## FINAL RUN DF-3954 (analysis)
DF-3954 radeon kv_dpm num_levels==0 wild read (simulation)
sizeof(struct kv_pl) = 12
num_levels(u32) = 0  =>  index = 0xffffffff  =>  displacement = 0xbfffffff4 (48.00 GiB)
kv_set_valid_clock_range :1721/:1745-1747 -> read at ps_obj + 0xbfffffff4
kv_dpm_get_sclk          :2886           -> read at ps_obj + 0xbfffffff4
kernel effect: unmapped/non-canonical address => page fault => panic
NON-CRASH MODE: analysis only. Re-run with 'crash' to execute the deref.
ANALYSIS_EXIT=0
########## FINAL RUN DF-3954 (crash)
DF-3954 radeon kv_dpm num_levels==0 wild read (simulation)
sizeof(struct kv_pl) = 12
num_levels(u32) = 0  =>  index = 0xffffffff  =>  displacement = 0xbfffffff4 (48.00 GiB)
kv_set_valid_clock_range :1721/:1745-1747 -> read at ps_obj + 0xbfffffff4
kv_dpm_get_sclk          :2886           -> read at ps_obj + 0xbfffffff4
kernel effect: unmapped/non-canonical address => page fault => panic
child: executing 'ps->levels[ps->num_levels - 1].sclk' (kv_dpm.c:1721) ...
DF-3954 radeon kv_dpm num_levels==0 wild read (simulation)
sizeof(struct kv_pl) = 12
num_levels(u32) = 0  =>  index = 0xffffffff  =>  displacement = 0xbfffffff4 (48.00 GiB)
kv_set_valid_clock_range :1721/:1745-1747 -> read at ps_obj + 0xbfffffff4
kv_dpm_get_sclk          :2886           -> read at ps_obj + 0xbfffffff4
kernel effect: unmapped/non-canonical address => page fault => panic
child: SIGNALLED sig=11 -> predicted wild read at +0xbfffffff4 confirmed faulting
RESULT: WILD READ FAULTS AS PREDICTED
CRASH_EXIT=0