⬢ DragonFlyBSD Kernel Audit
DF-3956 / run.log
← back to finding ↓ download raw
########## FINAL RUN DF-3956 (analysis)
DF-3956 radeon kv_dpm vid_mapping num_entries==0 (simulation)
producer: sumo_construct_vid_mapping_table -> num_entries = 0
consumer: kv_convert_vid2_to_vid7 :566 -> entries[0xffffffff] -> +0x3fffffffc (16.00 GiB)
kernel effect: wild read ~16 GiB past kv_power_info => page fault => panic
NON-CRASH MODE: analysis only. Re-run with 'crash' to execute the deref.
ANALYSIS_EXIT=0
########## FINAL RUN DF-3956 (crash)
DF-3956 radeon kv_dpm vid_mapping num_entries==0 (simulation)
producer: sumo_construct_vid_mapping_table -> num_entries = 0
consumer: kv_convert_vid2_to_vid7 :566 -> entries[0xffffffff] -> +0x3fffffffc (16.00 GiB)
kernel effect: wild read ~16 GiB past kv_power_info => page fault => panic
child: executing 'entries[num_entries - 1].vid_7bit' (kv_dpm.c:566) ...
DF-3956 radeon kv_dpm vid_mapping num_entries==0 (simulation)
producer: sumo_construct_vid_mapping_table -> num_entries = 0
consumer: kv_convert_vid2_to_vid7 :566 -> entries[0xffffffff] -> +0x3fffffffc (16.00 GiB)
kernel effect: wild read ~16 GiB past kv_power_info => page fault => panic
child: SIGNALLED sig=11 -> predicted wild read at +0x3fffffffc confirmed faulting
RESULT: WILD READ FAULTS AS PREDICTED
CRASH_EXIT=0