⬢ DragonFlyBSD Kernel Audit
DF-4273 / run.log
← back to finding ↓ download raw 
build_rc=0
DF-4273: twa passthru roundup2() 32-bit wrap arithmetic proof
(reproduces tw_osl_freebsd.c:927 with kernel types/macro)

device 0x1002 (3ware 9000 PCI) (sg_size_factor=512):
  buffer_length=0x00000000 -> kmalloc(0x0=0) copyin/copyout(0x00000000=0)
  buffer_length=0x00000100 -> kmalloc(0x200=512) copyin/copyout(0x00000100=256)
  buffer_length=0x00020000 -> kmalloc(0x20000=131072) copyin/copyout(0x00020000=131072)
  buffer_length=0x00020001 -> kmalloc(0x20200=131584) copyin/copyout(0x00020001=131073)   (over max I/O, unchecked)
  buffer_length=0x7FFFFFFF -> kmalloc(0x80000000=2147483648) copyin/copyout(0x7FFFFFFF=2147483647)   (over max I/O, unchecked)
  buffer_length=0xFFFFFC01 -> kmalloc(0xFFFFFE00=4294966784) copyin/copyout(0xFFFFFC01=4294966273)   (over max I/O, unchecked)
  buffer_length=0xFFFFFF00 -> kmalloc(0x0=0) copyin/copyout(0xFFFFFF00=4294967040)   (no-payload path taken)
  buffer_length=0xFFFFFF01 -> kmalloc(0x0=0) copyin/copyout(0xFFFFFF01=4294967041)   (no-payload path taken)
  buffer_length=0xFFFFFF80 -> kmalloc(0x0=0) copyin/copyout(0xFFFFFF80=4294967168)   (no-payload path taken)
  buffer_length=0xFFFFFFFF -> kmalloc(0x0=0) copyin/copyout(0xFFFFFFFF=4294967295)   (no-payload path taken)

devices 0x1003/0x1004/0x1005 (sg_size_factor=4):
  buffer_length=0x00000000 -> kmalloc(0x0=0) copyin/copyout(0x00000000=0)
  buffer_length=0x00000100 -> kmalloc(0x100=256) copyin/copyout(0x00000100=256)
  buffer_length=0x00020000 -> kmalloc(0x20000=131072) copyin/copyout(0x00020000=131072)
  buffer_length=0x00020001 -> kmalloc(0x20004=131076) copyin/copyout(0x00020001=131073)   (over max I/O, unchecked)
  buffer_length=0x7FFFFFFF -> kmalloc(0x80000000=2147483648) copyin/copyout(0x7FFFFFFF=2147483647)   (over max I/O, unchecked)
  buffer_length=0xFFFFFC01 -> kmalloc(0xFFFFFC04=4294966276) copyin/copyout(0xFFFFFC01=4294966273)   (over max I/O, unchecked)
  buffer_length=0xFFFFFF00 -> kmalloc(0xFFFFFF00=4294967040) copyin/copyout(0xFFFFFF00=4294967040)   (over max I/O, unchecked)
  buffer_length=0xFFFFFF01 -> kmalloc(0xFFFFFF04=4294967044) copyin/copyout(0xFFFFFF01=4294967041)   (over max I/O, unchecked)
  buffer_length=0xFFFFFF80 -> kmalloc(0xFFFFFF80=4294967168) copyin/copyout(0xFFFFFF80=4294967168)   (over max I/O, unchecked)
  buffer_length=0xFFFFFFFF -> kmalloc(0x0=0) copyin/copyout(0xFFFFFFFF=4294967295)   (no-payload path taken)

Probing for the twa(4) control device:
  open("/dev/twa0") = -1 (No such file or directory)
poc_rc=0