⬢ DragonFlyBSD Kernel Audit
DF-4270 / run.kld_fixed.log
← back to finding ↓ download raw
cc  -O2 -pipe   -D_KERNEL -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes  -Wmissing-prototypes -Wpointer-arith -Wcast-qual  -Wold-style-definition -Wmissing-include-dirs  -Wno-pointer-sign -Winit-self -Wundef -Wno-unused-but-set-variable -std=gnu11 -Werror -DKLD_MODULE -nostdinc  -I. -Idragonfly -I/root/dfwb3/forwarder_x86_64/include -Idragonfly/../include -I/usr/include  -Wold-style-declaration -fno-common -ffreestanding -fno-stack-protector -fno-strict-aliasing -fno-strict-overflow -fno-asynchronous-unwind-tables -fno-omit-frame-pointer -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float -mno-fp-ret-in-387 -mindirect-branch=thunk-inline   -c dfwb3_rig.c
wb_rxeof=0xffffffff808daed0 wb_init=0xffffffff808da750 wb_stop=0xffffffff808d9850 wb_start=0xffffffff808d9e90 wb_txeof.part.4=0xffffffff808da510 wb_watchdog=0xffffffff808dae60 mbstat=0xffffffff8131dec0 mbtypes=0xffffffff81325ec0
kern.dfwb3.rxeof: 0x0000000000000000 -> 0xffffffff808daed0
kern.dfwb3.init: 0x0000000000000000 -> 0xffffffff808da750
kern.dfwb3.stop: 0x0000000000000000 -> 0xffffffff808d9850
kern.dfwb3.start: 0x0000000000000000 -> 0xffffffff808d9e90
kern.dfwb3.txeof: 0x0000000000000000 -> 0xffffffff808da510
kern.dfwb3.watchdog: 0x0000000000000000 -> 0xffffffff808dae60
kern.dfwb3.mbstat: 0x0000000000000000 -> 0xffffffff8131dec0
kern.dfwb3.mbtypes: 0x0000000000000000 -> 0xffffffff81325ec0
=== go4270: REAL wb_start under cluster exhaustion (DF-4270) ===
kern.dfwb3.go4270: 0 -> 0
GO_RC=0
=== marker summary ===
dfwb3: cluster pool exhausted after 34716 clusters
dfwb3: saved-chain walk: 1 mbufs intact (m_len==128, marker ok: 1 damaged)
dfwb3: go4270 SURVIVED M-bM^@M^T guest stays up
---DMESG---
dfwb3: === DF-4270: force the wb_encap MCLGET-failure path under the REAL wb_start ===
dfwb3: crafted 17-mbuf chain, pkthdr.len=2176 (>16 fragments -> wb_encap coalesce branch; len > MHLEN -> MCLGET required)
dfwb3: baseline accounting: mbtypes[MT_DATA]=344 mbstat.m_drops=0 (chain included in baseline)
dfwb3: accounting self-test: +1 alloc observed: 1, back to 344: 1
dfwb3: cluster pool exhausted after 34716 clusters
dfwb3: post-drain mbstat.m_drops=1 (+1 M-bM^@M^T MCLGET failure signature, uipc_mbuf.c:1249) mbtypes=35060 (expect baseline+stash=35060)
dfwb3: ifsq_classic_enqueue -> 0 (0 = ok); mbtypes now 35060 (enqueue must not change it)
dfwb3: dispatching REAL wb_start (wb_encap is inlined into it; return value ignored at if_wb.c:1327)...
dfwb3: wb_start mbuf delta: -17 (LEAK expects +17; 0 means the chain was freed INSIDE wb_start!)
dfwb3: post-dispatch mbstat.m_drops=2 (+1 since pre-dispatch)
dfwb3: post-dispatch probe: MGETHDR ok; MCLGET FAILS
dfwb3: post-wb_start state:
dfwb3:   wb_tx_head=0 (== &chain[0]: 0)  wb_tx_tail=0  wb_tx_free=0xffffffff82650348
dfwb3:   chain[0].wb_mbuf=0 (NULL: 1 M-bM^@M^T wb_encap returned BEFORE :1283 set it)
dfwb3:   TX queue len=0 (packet dequeued and gone)
dfwb3:   frag[0]: status=0000000000 ctl=0x21000080 (FIRSTFRAG:1 TLINK:1 FINT:0 LASTFRAG:0)
dfwb3:   frags with OWN set: 0/16; frags with LASTFRAG set: 0/16 (unterminated chain: YES)
dfwb3:   frag[15].wb_next=0x26d62600 vs vtophys(&frag[16])=0x26d62600 (one-past-the-array walk)
dfwb3:   MMIO WB_TXSTART=0000000000 (0xFFFFFFFF: chip told to TRANSMIT the half-armed descriptor, if_wb.c:1355)
dfwb3:   if_timer=0 (5s watchdog armed)
dfwb3: accounting after evidence: mbtypes[MT_DATA]=35043 (chain-inclusive baseline 344 - 17 chain + 34716 stash + LEAK 0)
dfwb3: saved-chain walk: 1 mbufs intact (m_len==128, marker ok: 1 damaged)
dfwb3: wb_tx_head == NULL (nothing armed M-bM^@M^T FIXED behaviour): wb_txeof not dispatched (wb_intr's caller-side NULL guard, if_wb.c:1055-1056, applies)
dfwb3: dispatching REAL wb_watchdog (the 5s recovery path)...
dfwb3: after watchdog: wb_tx_head=0 (recovered: 1) mbtypes[MT_DATA]=35043 M-bM^@M^T leaked mbufs STILL leaked: no
dfwb3: cleanup: chain NOT freed by wb_start per accounting M-bM^@M^T NOT double-freeing; freeing stash only
dfwb3: rig cleanup complete: mbtypes[MT_DATA]=263 (baseline 344, delta -81 M-bM^@M^T accounting restored)
dfwb3: go4270 SURVIVED M-bM^@M^T guest stays up