⬢ DragonFlyBSD Kernel Audit
DF-4079 / run.log
← back to finding ↓ download raw
df4079: dispatching the REAL kernel oce_rq_handler()=0xffffffff805c9e50 (static oce_rx() runs inside it)
df4079: 16 real clusters posted via REAL oce_alloc_rx_bufs() (frag_size=2048)
df4079: === case 1: CQE pkt_size=16383 num_fragments=1 -> max chain data 1x2048 ===
df4079: REAL oce_rx delivered chain to if_input(ifp=0xfffff8008e0eb100): [0xfffff8011856a000 m_len=2048]
df4079: m_pkthdr.len (claimed) = 16383   sum(m_len) (actual) = 2048
df4079: *** CHAIN INVARIANT VIOLATION: pkthdr.len exceeds chain data by 14335 PHANTOM bytes (mbuf contract m_pkthdr.len == sum(m_len) broken by oce_rx, oce_if.c:1299) ***
df4079: === case 2: CQE pkt_size=16383 num_fragments=7 -> max chain data 7x2048=14336 (2047 phantom bytes) ===
df4079: REAL oce_rx delivered chain to if_input(ifp=0xfffff8008e0eb100): [0xfffff80118569e00 m_len=2048] [0xfffff80118569c00 m_len=2048] [0xfffff801184ddc00 m_len=2048] [0xfffff80118567600 m_len=2048] [0xfffff80117574800 m_len=2048] [0xfffff801184de200 m_len=2048] [0xfffff80118960c00 m_len=2048]
df4079: m_pkthdr.len (claimed) = 16383   sum(m_len) (actual) = 14336
df4079: *** CHAIN INVARIANT VIOLATION: pkthdr.len exceeds chain data by 2047 PHANTOM bytes (mbuf contract m_pkthdr.len == sum(m_len) broken by oce_rx, oce_if.c:1299) ***
df4079: chains delivered to if_input: 2; invariant violations: 2
df4079: rq->rx_stats: rx_compl=2 rx_pkts=2 rx_bytes=32766 (rx_bytes counted the PHANTOM pkt_size, oce_if.c:1381)
df4079: SURVIVED -- inconsistent mbuf chains demonstrated above