⬢ DragonFlyBSD Kernel Audit
DF-4165 / run.2.log
← back to finding ↓ download raw 
################ BASELINE (verbatim production code) ################
===== [BASELINE] MODE layout =====
layout: sizeof(struct integrated_info)=692
layout: sizeof(atom_integrated_system_info_v1_11)=1140
layout: sizeof(atom_hdmi_retimer_redriver_set)=27 (arrays: HdmiRegSetting[9]=18 B, Hdmi6GhzRegSetting[3]=6 B)
layout: dest dp0_ext_hdmi_reg_settings @582 [9]=18B, dp0_ext_hdmi_6g_reg_settings @601 [3]
layout: dest dp1 @609/6g @628  dp2 @636/6g @655  dp3 @663/6g @682  dp_ss_control(last) @688
layout: src  dp0_retimer_set @568 dp1 @595 dp2 @622 dp3 @649; HdmiRegSetting @3 Hdmi6GhzRegSetting @21 within set
layout: worst-case dp3 6G write reach: 500 bytes past struct end
----- rc=0 -----
===== [BASELINE] MODE dest-guard =====
[rig] SIGSEGV mode=dest-guard fix=baseline si_addr=0x800486000
[rig] fault offset in kzalloc'd struct integrated_info: 692 (sizeof=692) -> 0 bytes PAST the allocation end => OUT-OF-BOUNDS WRITE
[rig] fault offset in BIOS image: -4096 (bios_size=12288) => in image?!
----- rc=88 -----
===== [BASELINE] MODE src-guard =====
[rig] SIGSEGV mode=src-guard fix=baseline si_addr=0x80048e000
[rig] fault offset in BIOS image: 4096 (bios_size=4096) => READ BEYOND BIOS IMAGE (OOB READ)
----- rc=88 -----
===== [BASELINE] MODE canary =====
layout: sizeof(struct integrated_info)=692
layout: sizeof(atom_integrated_system_info_v1_11)=1140
layout: sizeof(atom_hdmi_retimer_redriver_set)=27 (arrays: HdmiRegSetting[9]=18 B, Hdmi6GhzRegSetting[3]=6 B)
layout: dest dp0_ext_hdmi_reg_settings @582 [9]=18B, dp0_ext_hdmi_6g_reg_settings @601 [3]
layout: dest dp1 @609/6g @628  dp2 @636/6g @655  dp3 @663/6g @682  dp_ss_control(last) @688
layout: src  dp0_retimer_set @568 dp1 @595 dp2 @622 dp3 @649; HdmiRegSetting @3 Hdmi6GhzRegSetting @21 within set
layout: worst-case dp3 6G write reach: 500 bytes past struct end
[rig] info=0x800485000 sizeof=692 victim=0x8004852b4..0x8004854b4 filled 0x41
[rig] image len=12288 isi_off=1024 (isi end=2164) master@32 counts hdmi={255,0,0,0} 6g={0,0,0,0}
[rig] -> bios_parser_create_integrated_info() [verbatim]
[rig] <- returned 0x800485000 (BP_RESULT_OK path)
[rig] VICTIM bytes changed: 400/512  first@victim+0 (struct+692, 0 past struct end)  last@victim+399 (399 past end)
[rig] VICTIM content == crafted-image byte at the exact source position: 400 match / 0 mismatch
[rig] victim[0..15] now: b9 ba bb bc bd be bf b0 b1 b2 b3 b4 b5 b6 b7 b8  (was 41 x512)
[rig] dp_ss_control (last member @688) = 0xb8b7b6b5 (kzalloc zeroed it; crafted-image value if overwritten: bcbbbab9)
[rig] stored counts: dp0=255/0 dp1=0/0 dp2=0/0 dp3=0/0 (hdmi/6g)
[rig] RESULT: ADJACENT-OBJECT CORRUPTION (every changed byte equals the crafted VBIOS byte)
----- rc=0 -----
===== [BASELINE] MODE canary6g =====
layout: sizeof(struct integrated_info)=692
layout: sizeof(atom_integrated_system_info_v1_11)=1140
layout: sizeof(atom_hdmi_retimer_redriver_set)=27 (arrays: HdmiRegSetting[9]=18 B, Hdmi6GhzRegSetting[3]=6 B)
layout: dest dp0_ext_hdmi_reg_settings @582 [9]=18B, dp0_ext_hdmi_6g_reg_settings @601 [3]
layout: dest dp1 @609/6g @628  dp2 @636/6g @655  dp3 @663/6g @682  dp_ss_control(last) @688
layout: src  dp0_retimer_set @568 dp1 @595 dp2 @622 dp3 @649; HdmiRegSetting @3 Hdmi6GhzRegSetting @21 within set
layout: worst-case dp3 6G write reach: 500 bytes past struct end
[rig] info=0x800485000 sizeof=692 victim=0x8004852b4..0x8004854b4 filled 0x41
[rig] image len=12288 isi_off=1024 (isi end=2164) master@32 counts hdmi={0,0,0,0} 6g={0,0,0,255}
[rig] -> bios_parser_create_integrated_info() [verbatim]
[rig] <- returned 0x800485000 (BP_RESULT_OK path)
[rig] VICTIM bytes changed: 500/512  first@victim+0 (struct+692, 0 past struct end)  last@victim+499 (499 past end)
[rig] VICTIM content == crafted-image byte at the exact source position: 500 match / 0 mismatch
[rig] victim[0..15] now: b8 b9 ba bb bc bd be bf b0 b1 b2 b3 b4 b5 b6 b7  (was 41 x512)
[rig] dp_ss_control (last member @688) = 0xb7b6b5b4 (kzalloc zeroed it; crafted-image value if overwritten: bbbab9b8)
[rig] stored counts: dp0=0/0 dp1=0/0 dp2=0/0 dp3=0/255 (hdmi/6g)
[rig] RESULT: ADJACENT-OBJECT CORRUPTION (every changed byte equals the crafted VBIOS byte)
----- rc=0 -----

################ FIXED (same slice + DF-4165 clamps) ################
===== [FIXED] MODE layout =====
layout: sizeof(struct integrated_info)=692
layout: sizeof(atom_integrated_system_info_v1_11)=1140
layout: sizeof(atom_hdmi_retimer_redriver_set)=27 (arrays: HdmiRegSetting[9]=18 B, Hdmi6GhzRegSetting[3]=6 B)
layout: dest dp0_ext_hdmi_reg_settings @582 [9]=18B, dp0_ext_hdmi_6g_reg_settings @601 [3]
layout: dest dp1 @609/6g @628  dp2 @636/6g @655  dp3 @663/6g @682  dp_ss_control(last) @688
layout: src  dp0_retimer_set @568 dp1 @595 dp2 @622 dp3 @649; HdmiRegSetting @3 Hdmi6GhzRegSetting @21 within set
layout: worst-case dp3 6G write reach: 500 bytes past struct end
----- rc=0 -----
===== [FIXED] MODE dest-guard =====
layout: sizeof(struct integrated_info)=692
layout: sizeof(atom_integrated_system_info_v1_11)=1140
layout: sizeof(atom_hdmi_retimer_redriver_set)=27 (arrays: HdmiRegSetting[9]=18 B, Hdmi6GhzRegSetting[3]=6 B)
layout: dest dp0_ext_hdmi_reg_settings @582 [9]=18B, dp0_ext_hdmi_6g_reg_settings @601 [3]
layout: dest dp1 @609/6g @628  dp2 @636/6g @655  dp3 @663/6g @682  dp_ss_control(last) @688
layout: src  dp0_retimer_set @568 dp1 @595 dp2 @622 dp3 @649; HdmiRegSetting @3 Hdmi6GhzRegSetting @21 within set
layout: worst-case dp3 6G write reach: 500 bytes past struct end
[rig] info=0x800485d4c  info+sizeof=0x800486000 (guard page starts 0x800486000)
[rig] image len=12288 isi_off=1024 (isi end=2164) master@32 counts hdmi={255,255,255,255} 6g={255,255,255,255}
[rig] -> bios_parser_create_integrated_info() [verbatim]
[rig] <- returned 0x800485d4c (BP_RESULT_OK path)
[rig] stored counts: dp0=9/3 dp1=9/3 dp2=9/3 dp3=9/3
[rig] GOOD: no fault with DF-4165 clamps active (expected)
----- rc=0 -----
===== [FIXED] MODE src-guard =====
layout: sizeof(struct integrated_info)=692
layout: sizeof(atom_integrated_system_info_v1_11)=1140
layout: sizeof(atom_hdmi_retimer_redriver_set)=27 (arrays: HdmiRegSetting[9]=18 B, Hdmi6GhzRegSetting[3]=6 B)
layout: dest dp0_ext_hdmi_reg_settings @582 [9]=18B, dp0_ext_hdmi_6g_reg_settings @601 [3]
layout: dest dp1 @609/6g @628  dp2 @636/6g @655  dp3 @663/6g @682  dp_ss_control(last) @688
layout: src  dp0_retimer_set @568 dp1 @595 dp2 @622 dp3 @649; HdmiRegSetting @3 Hdmi6GhzRegSetting @21 within set
layout: worst-case dp3 6G write reach: 500 bytes past struct end
[rig] info=0x800485000 (roomy) isi_off=2955 isi_end=4095 image_len=4096 (guard at 4096)
[rig] image len=4096 isi_off=2955 (isi end=4095) master@32 counts hdmi={0,0,0,0} 6g={0,0,0,255}
[rig] -> bios_parser_create_integrated_info() [verbatim]
[rig] <- returned 0x800485000 (BP_RESULT_OK path)
[rig] stored counts: dp0=0/0 dp1=0/0 dp2=0/0 dp3=0/3
[rig] GOOD: no fault with DF-4165 clamps active (expected)
----- rc=0 -----
===== [FIXED] MODE canary =====
layout: sizeof(struct integrated_info)=692
layout: sizeof(atom_integrated_system_info_v1_11)=1140
layout: sizeof(atom_hdmi_retimer_redriver_set)=27 (arrays: HdmiRegSetting[9]=18 B, Hdmi6GhzRegSetting[3]=6 B)
layout: dest dp0_ext_hdmi_reg_settings @582 [9]=18B, dp0_ext_hdmi_6g_reg_settings @601 [3]
layout: dest dp1 @609/6g @628  dp2 @636/6g @655  dp3 @663/6g @682  dp_ss_control(last) @688
layout: src  dp0_retimer_set @568 dp1 @595 dp2 @622 dp3 @649; HdmiRegSetting @3 Hdmi6GhzRegSetting @21 within set
layout: worst-case dp3 6G write reach: 500 bytes past struct end
[rig] info=0x800485000 sizeof=692 victim=0x8004852b4..0x8004854b4 filled 0x41
[rig] image len=12288 isi_off=1024 (isi end=2164) master@32 counts hdmi={255,0,0,0} 6g={0,0,0,0}
[rig] -> bios_parser_create_integrated_info() [verbatim]
[rig] <- returned 0x800485000 (BP_RESULT_OK path)
[rig] VICTIM bytes changed: 0/512  first@victim+18446744073709551615 (struct+691, 18446744073709551615 past struct end)  last@victim+0 (0 past end)
[rig] VICTIM content == crafted-image byte at the exact source position: 0 match / 0 mismatch
[rig] dp_ss_control (last member @688) = 0x00000000 (kzalloc zeroed it; crafted-image value if overwritten: bcbbbab9)
[rig] stored counts: dp0=9/0 dp1=0/0 dp2=0/0 dp3=0/0 (hdmi/6g)
[rig] RESULT: victim intact (no overflow)
----- rc=0 -----
===== [FIXED] MODE canary6g =====
layout: sizeof(struct integrated_info)=692
layout: sizeof(atom_integrated_system_info_v1_11)=1140
layout: sizeof(atom_hdmi_retimer_redriver_set)=27 (arrays: HdmiRegSetting[9]=18 B, Hdmi6GhzRegSetting[3]=6 B)
layout: dest dp0_ext_hdmi_reg_settings @582 [9]=18B, dp0_ext_hdmi_6g_reg_settings @601 [3]
layout: dest dp1 @609/6g @628  dp2 @636/6g @655  dp3 @663/6g @682  dp_ss_control(last) @688
layout: src  dp0_retimer_set @568 dp1 @595 dp2 @622 dp3 @649; HdmiRegSetting @3 Hdmi6GhzRegSetting @21 within set
layout: worst-case dp3 6G write reach: 500 bytes past struct end
[rig] info=0x800485000 sizeof=692 victim=0x8004852b4..0x8004854b4 filled 0x41
[rig] image len=12288 isi_off=1024 (isi end=2164) master@32 counts hdmi={0,0,0,0} 6g={0,0,0,255}
[rig] -> bios_parser_create_integrated_info() [verbatim]
[rig] <- returned 0x800485000 (BP_RESULT_OK path)
[rig] VICTIM bytes changed: 0/512  first@victim+18446744073709551615 (struct+691, 18446744073709551615 past struct end)  last@victim+0 (0 past end)
[rig] VICTIM content == crafted-image byte at the exact source position: 0 match / 0 mismatch
[rig] dp_ss_control (last member @688) = 0x00000000 (kzalloc zeroed it; crafted-image value if overwritten: bbbab9b8)
[rig] stored counts: dp0=0/0 dp1=0/0 dp2=0/0 dp3=0/3 (hdmi/6g)
[rig] RESULT: victim intact (no overflow)
----- rc=0 -----