⬢ DragonFlyBSD Kernel Audit
DF-4247 / run.2.log
← back to finding ↓ download raw 
################ BASELINE (verbatim production code) ################
===== [BASELINE] MODE layout =====
DF-4247 rig: slice=pp_slice.inc mode=layout
===== MODE layout =====
sizeof ATOM_PPLIB_POWERPLAYTABLE  = 37
sizeof ATOM_PPLIB_POWERPLAYTABLE3 = 46 (gate: extended-header parse)
sizeof ATOM_PPLIB_POWERPLAYTABLE4 = 66 (gate: dependency parse)
sizeof ATOM_PPLIB_POWERPLAYTABLE5 = 88 (gate: dpm2/cac-leakage)
offsetof PT4.usVddcDependencyOnSCLKOffset = 54
offsetof PT3.usExtendendedHeaderOffset   = 44
sizeof ATOM_PPLIB_EXTENDEDHEADER = 26
sizeof dep record = 5, dep table hdr = 6
sizeof ATOM_PPLIB_NONCLOCK_INFO = 24
sizeof VCEClockInfo = 6, UVDClockInfo = 6
sizeof phm_clock_voltage_dependency_table = 12 (dest over-reserve: alloc 8+12*n >= needed 4+8*n)
----- rc=0 -----
----- exit=0 -----
===== [BASELINE] MODE clean-valid =====
DF-4247 rig: slice=pp_slice.inc mode=clean-valid
===== MODE clean-valid =====
  pptable_init rc=0, dep count=3
  num_of_entries=1 rc=0
  get_entry(0) rc=0 cb_calls=1 -> PASS (unchanged behavior on valid input)
----- rc=0 -----
----- exit=0 -----
===== [BASELINE] MODE dep-offset-oob =====
DF-4247 rig: slice=pp_slice.inc mode=dep-offset-oob
===== MODE dep-offset-oob =====
  driving pptable_init with usVddcDependencyOnSCLKOffset=0xFF00 (image=128B)
  !! SIGSEGV (addr=0x800487e80) while: pptable_init -> init_clock_voltage_dependency -> get_clock_voltage_dependency_table: reading table->ucNumEntries at powerplay_table+0xFF00 (processpptables.c:1304-1309,385)
  => fault offset 65280 past image base (table size=128, mapping span=4096): READ FAR BEYOND POWERPLAY TABLE IMAGE (SOURCE OUT-OF-BOUNDS READ)
----- exit=88 -----
===== [BASELINE] MODE dep-count-255 =====
DF-4247 rig: slice=pp_slice.inc mode=dep-count-255
===== MODE dep-count-255 =====
  driving pptable_init: dep table at +128, ucNumEntries=255, only 3 records in image (image=144B)
  !! SIGSEGV (addr=0x800478002) while: pptable_init -> init_clock_voltage_dependency -> get_clock_voltage_dependency_table: loop reading table->entries[i] past the table image (processpptables.c:393-399)
  => fault offset 146 past image base (table size=144, mapping span=4096): READ FAR BEYOND POWERPLAY TABLE IMAGE (SOURCE OUT-OF-BOUNDS READ)
----- exit=88 -----
===== [BASELINE] MODE leak-canary =====
DF-4247 rig: slice=pp_slice.inc mode=leak-canary
===== MODE leak-canary =====
  driving pptable_init: dep table at +128, ucNumEntries=40, only 5 records in image (image=154B)
  pptable_init rc=0, dep count=see below
  parsed count=40 (of 40 claimed)
  parsed count=40; comparing entries[5..] against victim bytes past image end (kernel-heap analog):
    entry[5] clk=00524b44 (victim-derived expect 00524b44) v=18009 (expect 18009) MATCH
    entry[6] clk=0041544d (victim-derived expect 0041544d) v=20296 (expect 20296) MATCH
    entry[7] clk=004a4356 (victim-derived expect 004a4356) v=22609 (expect 22609) MATCH
    entry[8] clk=00534c45 (victim-derived expect 00534c45) v=18266 (expect 18266) MATCH
  => 70/70 leaked field values byte-exact with kernel-memory analog past the table image
----- rc=0 -----
----- exit=0 -----
===== [BASELINE] MODE statearray-offset-oob =====
DF-4247 rig: slice=pp_slice.inc mode=statearray-offset-oob
===== MODE statearray-offset-oob =====
  driving get_num_of_entries with usStateArrayOffset=0xFF00
  !! SIGSEGV (addr=0x800487e80) while: pp_tables_get_num_of_entries: reading pstate_arrays->ucNumEntries at powerplay_table+usStateArrayOffset=0xFF00 (processpptables.c:875-878)
  => fault offset 65280 past image base (table size=128, mapping span=4096): READ FAR BEYOND POWERPLAY TABLE IMAGE (SOURCE OUT-OF-BOUNDS READ)
----- exit=88 -----
===== [BASELINE] MODE entry-v2-offbyone =====
DF-4247 rig: slice=pp_slice.inc mode=entry-v2-offbyone
===== MODE entry-v2-offbyone =====
  num_of_entries=4 rc=0; requesting entry_index=4 (== ucNumEntries; guard at processpptables.c:913 is '>', accepts one-past)
  !! SIGSEGV (addr=0x800478001) while: pp_tables_get_entry(N) -> get_state_entry_v2 walks N entries -> reads pstate_entry_v2->nonClockInfoIndex at image end (processpptables.c:913-924)
  => fault offset 142 past image base (table size=141, mapping span=4096): READ FAR BEYOND POWERPLAY TABLE IMAGE (SOURCE OUT-OF-BOUNDS READ)
----- exit=88 -----
===== [BASELINE] MODE entry-v1-offbyone =====
DF-4247 rig: slice=pp_slice.inc mode=entry-v1-offbyone
===== MODE entry-v1-offbyone =====
  driving get_entry(4) with ucNumStates=4, states ending at image end (136B)
  !! SIGSEGV (addr=0x800478000) while: pp_tables_get_entry(ucNumStates) on format<6 table: reads pstate_entry->ucNonClockStateIndex one past the states array (processpptables.c:937-947)
  => fault offset 136 past image base (table size=136, mapping span=4096): READ FAR BEYOND POWERPLAY TABLE IMAGE (SOURCE OUT-OF-BOUNDS READ)
----- exit=88 -----
===== [BASELINE] MODE nonclock-index-255 =====
DF-4247 rig: slice=pp_slice.inc mode=nonclock-index-255
===== MODE nonclock-index-255 =====
  driving get_entry(0) with nonClockInfoIndex=0xFF, ucEntrySize=0xFF
  !! SIGSEGV (addr=0x800487dd9) while: pp_tables_get_entry(0): pnon_clock_info = nonClockInfo + 0xFF*0xFF (65025B past array) -> init_non_clock_fields reads usClassification (processpptables.c:923-926,685)
  => fault offset 65227 past image base (table size=242, mapping span=4096): READ FAR BEYOND POWERPLAY TABLE IMAGE (SOURCE OUT-OF-BOUNDS READ)
----- exit=88 -----
===== [BASELINE] MODE clockinfo-index-255 =====
DF-4247 rig: slice=pp_slice.inc mode=clockinfo-index-255
===== MODE clockinfo-index-255 =====
  driving get_entry(0) with clockInfoIndex[0]=0xFF, ucEntrySize=0xFF
  !! SIGSEGV (addr=0x800487db1) while: pp_tables_get_entry(0): parser computes pclock_info = clockInfo + 0xFF*0xFF past the array (processpptables.c:929-932); callback (production: the smu7/smu8 phm clock-info handlers) dereferences it
  => fault offset 65187 past image base (table size=242, mapping span=4096): READ FAR BEYOND POWERPLAY TABLE IMAGE (SOURCE OUT-OF-BOUNDS READ)
----- exit=88 -----
===== [BASELINE] MODE uvd-array-index =====
DF-4247 rig: slice=pp_slice.inc mode=uvd-array-index
===== MODE uvd-array-index =====
  driving pptable_init: UVD array (0 entries) at image end, limit record ucUVDClockInfoIndex=0xFF (image=134B)
  !! SIGSEGV (addr=0x8004785f8) while: pptable_init -> init_clock_voltage_dependency -> get_uvd_clock_voltage_limit_table: reads array->entries[0xFF] (ucVClkHigh/usVClkLow) past the table image (processpptables.c:1099-1107)
  => fault offset 1662 past image base (table size=134, mapping span=4096): READ FAR BEYOND POWERPLAY TABLE IMAGE (SOURCE OUT-OF-BOUNDS READ)
----- exit=88 -----
===== [BASELINE] MODE vce-clockinfo-index =====
DF-4247 rig: slice=pp_slice.inc mode=vce-clockinfo-index
===== MODE vce-clockinfo-index =====
  vce state entries=1; requesting entry 0 with ucVCEClockInfoIndex=0xFF
  !! SIGSEGV (addr=0x8004785f8) while: pptable_get_vce_state_table_entry: reads vce_clock_info_array->entries[0xFF].ucEVClkHigh past the table image (processpptables.c:1571-1585)
  => fault offset 1662 past image base (table size=134, mapping span=4096): READ FAR BEYOND POWERPLAY TABLE IMAGE (SOURCE OUT-OF-BOUNDS READ)
----- exit=88 -----
===== [BASELINE] MODE fwinfo-null =====
DF-4247 rig: slice=pp_slice.inc mode=fwinfo-null
===== MODE fwinfo-null =====
  driving pptable_init with FirmwareInfo table ABSENT (smu_atom_get_data_table returns NULL)
  !! SIGSEGV (addr=0x2) while: pptable_init -> init_overdrive_limits: fw_info = smu_atom_get_data_table(FirmwareInfo) == NULL, then fw_info->ucTableFormatRevision dereferenced (processpptables.c:1062-1066)
  => NULL DEREF: read at NULL+0x2
----- exit=88 -----

################ FIXED (same slice + DF-4247 fix.diff) ################
===== [FIXED] MODE layout =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=layout
===== MODE layout =====
sizeof ATOM_PPLIB_POWERPLAYTABLE  = 37
sizeof ATOM_PPLIB_POWERPLAYTABLE3 = 46 (gate: extended-header parse)
sizeof ATOM_PPLIB_POWERPLAYTABLE4 = 66 (gate: dependency parse)
sizeof ATOM_PPLIB_POWERPLAYTABLE5 = 88 (gate: dpm2/cac-leakage)
offsetof PT4.usVddcDependencyOnSCLKOffset = 54
offsetof PT3.usExtendendedHeaderOffset   = 44
sizeof ATOM_PPLIB_EXTENDEDHEADER = 26
sizeof dep record = 5, dep table hdr = 6
sizeof ATOM_PPLIB_NONCLOCK_INFO = 24
sizeof VCEClockInfo = 6, UVDClockInfo = 6
sizeof phm_clock_voltage_dependency_table = 12 (dest over-reserve: alloc 8+12*n >= needed 4+8*n)
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE clean-valid =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=clean-valid
===== MODE clean-valid =====
  pptable_init rc=0, dep count=3
  num_of_entries=1 rc=0
  get_entry(0) rc=0 cb_calls=1 -> PASS (unchanged behavior on valid input)
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE dep-offset-oob =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=dep-offset-oob
===== MODE dep-offset-oob =====
  driving pptable_init with usVddcDependencyOnSCLKOffset=0xFF00 (image=128B)
  pptable_init returned 0 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE dep-count-255 =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=dep-count-255
===== MODE dep-count-255 =====
  driving pptable_init: dep table at +128, ucNumEntries=255, only 3 records in image (image=144B)
  pptable_init rc=0, dep count=see below
  parsed count=3 (of 255 claimed)
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE leak-canary =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=leak-canary
===== MODE leak-canary =====
  driving pptable_init: dep table at +128, ucNumEntries=40, only 5 records in image (image=154B)
  pptable_init rc=0, dep count=see below
  parsed count=5 (of 40 claimed)
  parsed count=5; comparing entries[5..] against victim bytes past image end (kernel-heap analog):
  => 0/0 leaked field values byte-exact with kernel-memory analog past the table image
  (no out-of-image entries parsed: count clamped to the 5 records that fit in the image)
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE statearray-offset-oob =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=statearray-offset-oob
===== MODE statearray-offset-oob =====
  driving get_num_of_entries with usStateArrayOffset=0xFF00
  get_num_of_entries rc=-1 n=0 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE entry-v2-offbyone =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=entry-v2-offbyone
===== MODE entry-v2-offbyone =====
  num_of_entries=4 rc=0; requesting entry_index=4 (== ucNumEntries; guard at processpptables.c:913 is '>', accepts one-past)
  get_entry(4) rc=-1 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE entry-v1-offbyone =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=entry-v1-offbyone
===== MODE entry-v1-offbyone =====
  driving get_entry(4) with ucNumStates=4, states ending at image end (136B)
  get_entry(4) rc=-1 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE nonclock-index-255 =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=nonclock-index-255
===== MODE nonclock-index-255 =====
  driving get_entry(0) with nonClockInfoIndex=0xFF, ucEntrySize=0xFF
  get_entry rc=-1 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE clockinfo-index-255 =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=clockinfo-index-255
===== MODE clockinfo-index-255 =====
  driving get_entry(0) with clockInfoIndex[0]=0xFF, ucEntrySize=0xFF
  get_entry rc=-22 cb_calls=0 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE uvd-array-index =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=uvd-array-index
===== MODE uvd-array-index =====
  driving pptable_init: UVD array (0 entries) at image end, limit record ucUVDClockInfoIndex=0xFF (image=134B)
  pptable_init rc=0 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE vce-clockinfo-index =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=vce-clockinfo-index
===== MODE vce-clockinfo-index =====
  vce state entries=1; requesting entry 0 with ucVCEClockInfoIndex=0xFF
  get_vce_state_table_entry rc=-22 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE fwinfo-null =====
DF-4247 rig: slice=pp_slice_fixed.inc mode=fwinfo-null
===== MODE fwinfo-null =====
  driving pptable_init with FirmwareInfo table ABSENT (smu_atom_get_data_table returns NULL)
  pptable_init rc=0 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----