⬢ DragonFlyBSD Kernel Audit
DF-4388 / run.2.log
← back to finding ↓ download raw 
################ BASELINE (verbatim production code) ################
===== [BASELINE] MODE layout =====
DF-4388 rig: slice=pp_slice.inc mode=layout
===== MODE layout =====
sizeof ATOM_Tonga_POWERPLAYTABLE = 77
offsetof usStateArrayOffset=35 usFanTableOffset=37 usThermalControllerOffset=39
offsetof usMclkDependencyTableOffset=43 usSclkDependencyTableOffset=45
offsetof usVddcLookupTableOffset=47 usVddgfxLookupTableOffset=49
offsetof usMMDependencyTableOffset=51 usVCEStateTableOffset=53 usPPMTableOffset=55
offsetof usPowerTuneTableOffset=57 usHardLimitTableOffset=59 usPCIETableOffset=61 usGPIOTableOffset=63
sizeof ATOM_Tonga_State=20 State_Array hdr=2
sizeof SCLK rec=11 (Tonga) 15 (Polaris); MCLK rec=13; MM rec=23; PCIE rec=4/8; lookup rec=8
sizeof VCE state rec=4 tbl=6; hard-limit rec=14; GPIO tbl=7; PPM=36; thermal=9; fan(Tonga)=31 fan(Fiji)=45; PowerTune(Tonga)=31 (Fiji)=48
sizeof phm_ppt_v1_voltage_lookup_record=10 -> get_vddc_lookup_table alloc = 4+10*16 = 164 for up to 255 firmware entries
sizeof phm_ppt_v1_clock_voltage_dependency_record=28; mm rec=32; pcie rec=12; phm_clock_array=8
AMD_MAX_VCE_LEVELS=6; ATOM_Tonga_TABLE_REVISION_TONGA=7
----- rc=0 -----
----- exit=0 -----
===== [BASELINE] MODE clean-valid =====
DF-4388 rig: slice=pp_slice.inc mode=clean-valid
===== MODE clean-valid =====
  pptable_init rc=0
  vddc_lookup=4 vddgfx_lookup=2 sclk_dep=3 mclk_dep=2 mm_dep=2 pcie=1 ppm=1
  hard_limits: sclk=110000 mclk=200000 vddc=1200
  TDP=250 fan_tmin=2500
  num_entries=2; entry(0) rc=0 cb=1 vce_states=2 evclk[0]=100000 sclk[0]=30000
  => PASS (valid table parses fully, both builds must agree)
----- rc=0 -----
----- exit=0 -----
===== [BASELINE] MODE vddc-lookup-255-write =====
DF-4388 rig: slice=pp_slice.inc mode=vddc-lookup-255-write
===== MODE vddc-lookup-255-write =====
  driving pptable_init: usVddcLookupTableOffset=512 with ucNumEntries=255 (all source records in-image; destination allocated for max_levels=16)
  !! SIGSEGV (addr=0x800483000) while: pptable_init -> init_dpm_2_parameters -> get_vddc_lookup_table: copy loop writes entries[i] for i<ucNumEntries=255 into kzalloc(4+10*16=164): DESTINATION HEAP OOB WRITE (process_pptables_v1_0.c:176-190)
  => fault 0 bytes PAST THE END of a kzalloc(164) destination object: DESTINATION HEAP OUT-OF-BOUNDS WRITE (first OOB byte at +164)
----- exit=88 -----
===== [BASELINE] MODE statearray-offset-oob =====
DF-4388 rig: slice=pp_slice.inc mode=statearray-offset-oob
===== MODE statearray-offset-oob =====
  driving with check_powerplay_tables reads state_arrays->ucNumEntries at powerplay_table+0xFF00 (:1042-1053)
  !! SIGSEGV (addr=0x800488e01) while: pptable_init with oversized USHORT sub-table offset (0xFF00) -- unvalidated dereference
  => fault at image+65281, FAR BEYOND the table image (size=256): SOURCE OUT-OF-BOUNDS READ past the image end (guard page or unmapped)
----- exit=88 -----
===== [BASELINE] MODE thermal-offset-oob =====
DF-4388 rig: slice=pp_slice.inc mode=thermal-offset-oob
===== MODE thermal-offset-oob =====
  driving with init_thermal_controller reads thermal_controller->ucType at powerplay_table+0xFF00 (:891-897)
  !! SIGSEGV (addr=0x800488e01) while: pptable_init with oversized USHORT sub-table offset (0xFF00) -- unvalidated dereference
  => fault at image+65281, FAR BEYOND the table image (size=256): SOURCE OUT-OF-BOUNDS READ past the image end (guard page or unmapped)
----- exit=88 -----
===== [BASELINE] MODE fan-offset-oob =====
DF-4388 rig: slice=pp_slice.inc mode=fan-offset-oob
===== MODE fan-offset-oob =====
  driving with init_thermal_controller reads fan_table->ucRevId at powerplay_table+0xFF00 (:922-929)
  !! SIGSEGV (addr=0x800488e00) while: pptable_init with oversized USHORT sub-table offset (0xFF00) -- unvalidated dereference
  => fault at image+65280, FAR BEYOND the table image (size=256): SOURCE OUT-OF-BOUNDS READ past the image end (guard page or unmapped)
----- exit=88 -----
===== [BASELINE] MODE sclkdep-offset-oob =====
DF-4388 rig: slice=pp_slice.inc mode=sclkdep-offset-oob
===== MODE sclkdep-offset-oob =====
  driving with get_sclk_voltage_dependency_table reads sclk_dep_table->ucRevId at powerplay_table+0xFF00 (:781-783,420)
  !! SIGSEGV (addr=0x800488e00) while: pptable_init with oversized USHORT sub-table offset (0xFF00) -- unvalidated dereference
  => fault at image+65280, FAR BEYOND the table image (size=256): SOURCE OUT-OF-BOUNDS READ past the image end (guard page or unmapped)
----- exit=88 -----
===== [BASELINE] MODE ppm-offset-oob =====
DF-4388 rig: slice=pp_slice.inc mode=ppm-offset-oob
===== MODE ppm-offset-oob =====
  driving with get_platform_power_management_table reads atom_ppm_table->ucPpmDesign at powerplay_table+0xFF00 (:301-305,214-215)
  !! SIGSEGV (addr=0x800488e01) while: pptable_init with oversized USHORT sub-table offset (0xFF00) -- unvalidated dereference
  => fault at image+65281, FAR BEYOND the table image (size=256): SOURCE OUT-OF-BOUNDS READ past the image end (guard page or unmapped)
----- exit=88 -----
===== [BASELINE] MODE vce-offset-oob =====
DF-4388 rig: slice=pp_slice.inc mode=vce-offset-oob
===== MODE vce-offset-oob =====
  driving with ppt_get_num_of_vce_state_table_entries_v1_0 reads vce_state_table->ucNumEntries at powerplay_table+0xFF00 (:1219-1222)
  !! SIGSEGV (addr=0x800488e01) while: get_powerplay_table_entry_v1_0 -> ppt_get_num_of_vce_state_table_entries_v1_0: reading at powerplay_table+0xFF00
  => fault at image+65281, FAR BEYOND the table image (size=256): SOURCE OUT-OF-BOUNDS READ past the image end (guard page or unmapped)
----- exit=88 -----
===== [BASELINE] MODE sclk-count-255 =====
DF-4388 rig: slice=pp_slice.inc mode=sclk-count-255
===== MODE sclk-count-255 =====
  driving pptable_init: sclk dep at +96, ucNumEntries=255, only 3 records in image (image=131B)
  !! SIGSEGV (addr=0x800479000) while: pptable_init -> get_sclk_voltage_dependency_table: loop reads tonga_table->entries[i] past the table image (process_pptables_v1_0.c:438-451)
  => fault at image+131, FAR BEYOND the table image (size=131): SOURCE OUT-OF-BOUNDS READ past the image end (guard page or unmapped)
----- exit=88 -----
===== [BASELINE] MODE leak-canary =====
DF-4388 rig: slice=pp_slice.inc mode=leak-canary
===== MODE leak-canary =====
  driving pptable_init: mm dep at +128, ucNumEntries=40, only 5 records in image (image=245B, 1024B victim tail)
  pptable_init rc=0, mm count=40; comparing parsed entries[5..] against victim bytes past image end:
    entry[5] eclk=1481722435 (victim 1481722435) aclk=1515408453 (victim 1515408453) samu=1112886855 (victim 1112886855) MATCH
    entry[6] eclk=1129729864 (victim 1129729864) aclk=1163415882 (victim 1163415882) samu=1197101900 (victim 1197101900) MATCH
  => 175/175 leaked field values byte-exact with kernel-memory analog past the table image
----- rc=0 -----
----- exit=0 -----
===== [BASELINE] MODE vce-sclk-index-255 =====
DF-4388 rig: slice=pp_slice.inc mode=vce-sclk-index-255
===== MODE vce-sclk-index-255 =====
  driving get_powerplay_table_entry_v1_0(0) with VCE record ucSCLKIndex=0xFF (1-entry sclk dep table, image=256B)
  !! SIGSEGV (addr=0x800479a62) while: get_powerplay_table_entry_v1_0 -> ppt_get_vce_state_table_entry_v1_0: sclk_dep_record = entries[ucSCLKIndex=0xFF] = sclk_table + 2 + 255*11 (2807B past the dep table) -> reads ulSclk (process_pptables_v1_0.c:1249-1252,1261)
  => fault at image+2914, FAR BEYOND the table image (size=256): SOURCE OUT-OF-BOUNDS READ past the image end (guard page or unmapped)
----- exit=88 -----
===== [BASELINE] MODE vce-mclk-underflow =====
DF-4388 rig: slice=pp_slice.inc mode=vce-mclk-underflow
===== MODE vce-mclk-underflow =====
  driving get_powerplay_table_entry_v1_0(0): mclk dep at +2 with ucNumEntries=0, VCE record ucMCLKIndex=0 -> entries[-1] underflow read before the image
  !! SIGSEGV (addr=0x800478ffe) while: get_powerplay_table_entry_v1_0 -> ppt_get_vce_state_table_entry_v1_0: ucMCLKIndex(0) >= ucNumEntries(0) -> entries[ucNumEntries-1] = entries[-1] = mclk_table+2-13 (record starts 11B BEFORE the image; ulMclk read at image-4) (process_pptables_v1_0.c:1263-1267)
  => fault at image-2 (table base=0x800479000): READ BEFORE THE TABLE IMAGE (NEGATIVE-INDEX UNDERFLOW, entries[-1]-style)
----- exit=88 -----
===== [BASELINE] MODE entry-offbyone =====
DF-4388 rig: slice=pp_slice.inc mode=entry-offbyone
===== MODE entry-offbyone =====
  driving get_powerplay_table_entry_v1_0(entry_index=2 == ucNumEntries) with the 2 states ending exactly at image end (170B)
  !! SIGSEGV (addr=0x800479008) while: get_powerplay_table_entry_v1_0(2) with ucNumEntries=2: guard is entry_index <= ucNumEntries -> state_entry = entries[2] past the array -> reads state_entry->usClassification at image end +10 (process_pptables_v1_0.c:1310-1321)
  => fault at image+178, FAR BEYOND the table image (size=170): SOURCE OUT-OF-BOUNDS READ past the image end (guard page or unmapped)
----- exit=88 -----
===== [BASELINE] MODE pcie-null-vdddepsclk =====
DF-4388 rig: slice=pp_slice.inc mode=pcie-null-vdddepsclk
===== MODE pcie-null-vdddepsclk =====
  driving pptable_init: PCIE table present, usSclkDependencyTableOffset=0 (vdd_dep_on_sclk NULL)
  !! SIGSEGV (addr=0x0) while: pptable_init -> init_clock_voltage_dependency -> get_pcie_table: pcie_count = pp_table_information->vdd_dep_on_sclk->count with vdd_dep_on_sclk == NULL (process_pptables_v1_0.c:522)
  => NULL DEREF: access at NULL+0x0 (struct field read through a NULL table pointer)
----- exit=88 -----
===== [BASELINE] MODE gpio-null-vdddepsclk =====
DF-4388 rig: slice=pp_slice.inc mode=gpio-null-vdddepsclk
===== MODE gpio-null-vdddepsclk =====
  driving pptable_init: GPIO table present, usSclkDependencyTableOffset=0 (vdd_dep_on_sclk NULL)
  !! SIGSEGV (addr=0x0) while: pptable_init -> init_clock_voltage_dependency -> get_gpio_table: pp_table_information->vdd_dep_on_sclk->count with vdd_dep_on_sclk == NULL (process_pptables_v1_0.c:745)
  => NULL DEREF: access at NULL+0x0 (struct field read through a NULL table pointer)
----- exit=88 -----
===== [BASELINE] MODE gpio-gate-zero-offset =====
DF-4388 rig: slice=pp_slice.inc mode=gpio-gate-zero-offset
===== MODE gpio-gate-zero-offset =====
  driving pptable_init with usGPIOTableOffset=0 and a valid 1-entry sclk dep table (count=1); GPIO gate must skip, instead the header byte img[1]=2 is read as the VRHot DPM index
amdgpu: [powerplay] SCLK DPM index for VRHot cannot exceed the total sclk level count!
  pptable_init rc=0; gpio_table=PARSED (baseline: parsed from the wrong table despite offset 0)
----- rc=0 -----
----- exit=0 -----
===== [BASELINE] MODE vce-count-unclamped =====
DF-4388 rig: slice=pp_slice.inc mode=vce-count-unclamped
===== MODE vce-count-unclamped =====
  driving get_powerplay_table_entry_v1_0(0) with VCE ucNumEntries=200 (AMD_MAX_VCE_LEVELS=6)
  rc=0; hwmgr->num_vce_state_tables STORED = 200 (vce_states[] holds 6)
----- rc=0 -----
----- exit=0 -----

################ FIXED (same slice + DF-4388 fix.diff) ################
===== [FIXED] MODE layout =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=layout
===== MODE layout =====
sizeof ATOM_Tonga_POWERPLAYTABLE = 77
offsetof usStateArrayOffset=35 usFanTableOffset=37 usThermalControllerOffset=39
offsetof usMclkDependencyTableOffset=43 usSclkDependencyTableOffset=45
offsetof usVddcLookupTableOffset=47 usVddgfxLookupTableOffset=49
offsetof usMMDependencyTableOffset=51 usVCEStateTableOffset=53 usPPMTableOffset=55
offsetof usPowerTuneTableOffset=57 usHardLimitTableOffset=59 usPCIETableOffset=61 usGPIOTableOffset=63
sizeof ATOM_Tonga_State=20 State_Array hdr=2
sizeof SCLK rec=11 (Tonga) 15 (Polaris); MCLK rec=13; MM rec=23; PCIE rec=4/8; lookup rec=8
sizeof VCE state rec=4 tbl=6; hard-limit rec=14; GPIO tbl=7; PPM=36; thermal=9; fan(Tonga)=31 fan(Fiji)=45; PowerTune(Tonga)=31 (Fiji)=48
sizeof phm_ppt_v1_voltage_lookup_record=10 -> get_vddc_lookup_table alloc = 4+10*16 = 164 for up to 255 firmware entries
sizeof phm_ppt_v1_clock_voltage_dependency_record=28; mm rec=32; pcie rec=12; phm_clock_array=8
AMD_MAX_VCE_LEVELS=6; ATOM_Tonga_TABLE_REVISION_TONGA=7
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE clean-valid =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=clean-valid
===== MODE clean-valid =====
  pptable_init rc=0
  vddc_lookup=4 vddgfx_lookup=2 sclk_dep=3 mclk_dep=2 mm_dep=2 pcie=1 ppm=1
  hard_limits: sclk=110000 mclk=200000 vddc=1200
  TDP=250 fan_tmin=2500
  num_entries=2; entry(0) rc=0 cb=1 vce_states=2 evclk[0]=100000 sclk[0]=30000
  => PASS (valid table parses fully, both builds must agree)
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE vddc-lookup-255-write =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=vddc-lookup-255-write
===== MODE vddc-lookup-255-write =====
  driving pptable_init: usVddcLookupTableOffset=512 with ucNumEntries=255 (all source records in-image; destination allocated for max_levels=16)
  pptable_init rc=0, vddc_lookup count=16
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE statearray-offset-oob =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=statearray-offset-oob
===== MODE statearray-offset-oob =====
  driving with check_powerplay_tables reads state_arrays->ucNumEntries at powerplay_table+0xFF00 (:1042-1053)
amdgpu: [powerplay] check_powerplay_tables failed
  pptable_init rc=-1 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE thermal-offset-oob =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=thermal-offset-oob
===== MODE thermal-offset-oob =====
  driving with init_thermal_controller reads thermal_controller->ucType at powerplay_table+0xFF00 (:891-897)
amdgpu: [powerplay] init_thermal_controller failed
  pptable_init rc=-1 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE fan-offset-oob =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=fan-offset-oob
===== MODE fan-offset-oob =====
  driving with init_thermal_controller reads fan_table->ucRevId at powerplay_table+0xFF00 (:922-929)
amdgpu: [powerplay] init_thermal_controller failed
  pptable_init rc=-1 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE sclkdep-offset-oob =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=sclkdep-offset-oob
===== MODE sclkdep-offset-oob =====
  driving with get_sclk_voltage_dependency_table reads sclk_dep_table->ucRevId at powerplay_table+0xFF00 (:781-783,420)
amdgpu: [powerplay] init_clock_voltage_dependency failed
  pptable_init rc=-22 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE ppm-offset-oob =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=ppm-offset-oob
===== MODE ppm-offset-oob =====
  driving with get_platform_power_management_table reads atom_ppm_table->ucPpmDesign at powerplay_table+0xFF00 (:301-305,214-215)
amdgpu: [powerplay] init_dpm_2_parameters failed
  pptable_init rc=-22 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE vce-offset-oob =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=vce-offset-oob
===== MODE vce-offset-oob =====
  driving with ppt_get_num_of_vce_state_table_entries_v1_0 reads vce_state_table->ucNumEntries at powerplay_table+0xFF00 (:1219-1222)
  get_powerplay_table_entry rc=0 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE sclk-count-255 =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=sclk-count-255
===== MODE sclk-count-255 =====
  driving pptable_init: sclk dep at +96, ucNumEntries=255, only 3 records in image (image=131B)
  pptable_init rc=0, sclk_dep count=3
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE leak-canary =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=leak-canary
===== MODE leak-canary =====
  driving pptable_init: mm dep at +128, ucNumEntries=40, only 5 records in image (image=245B, 1024B victim tail)
  pptable_init rc=0, mm count=5; comparing parsed entries[5..] against victim bytes past image end:
  => 0/0 leaked field values byte-exact with kernel-memory analog past the table image
  (no out-of-image entries parsed: count clamped to the 5 records that fit in the image)
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE vce-sclk-index-255 =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=vce-sclk-index-255
===== MODE vce-sclk-index-255 =====
  driving get_powerplay_table_entry_v1_0(0) with VCE record ucSCLKIndex=0xFF (1-entry sclk dep table, image=256B)
  rc=0 num_vce=1 vce_states[0].sclk=0 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE vce-mclk-underflow =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=vce-mclk-underflow
===== MODE vce-mclk-underflow =====
  driving get_powerplay_table_entry_v1_0(0): mclk dep at +2 with ucNumEntries=0, VCE record ucMCLKIndex=0 -> entries[-1] underflow read before the image
  rc=0 num_vce=1 vce_states[0].mclk=0 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE entry-offbyone =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=entry-offbyone
===== MODE entry-offbyone =====
  driving get_powerplay_table_entry_v1_0(entry_index=2 == ucNumEntries) with the 2 states ending exactly at image end (170B)
amdgpu: [powerplay] Invalid PowerPlay Table State Array Entry.
  rc=-1 cb=0 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE pcie-null-vdddepsclk =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=pcie-null-vdddepsclk
===== MODE pcie-null-vdddepsclk =====
  driving pptable_init: PCIE table present, usSclkDependencyTableOffset=0 (vdd_dep_on_sclk NULL)
amdgpu: [powerplay] Missing SCLK dependency table for PCIE table!
amdgpu: [powerplay] init_clock_voltage_dependency failed
  pptable_init rc=-22 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE gpio-null-vdddepsclk =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=gpio-null-vdddepsclk
===== MODE gpio-null-vdddepsclk =====
  driving pptable_init: GPIO table present, usSclkDependencyTableOffset=0 (vdd_dep_on_sclk NULL)
amdgpu: [powerplay] Missing SCLK dependency table for GPIO table!
amdgpu: [powerplay] init_clock_voltage_dependency failed
  pptable_init rc=-22 WITHOUT faulting
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE gpio-gate-zero-offset =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=gpio-gate-zero-offset
===== MODE gpio-gate-zero-offset =====
  driving pptable_init with usGPIOTableOffset=0 and a valid 1-entry sclk dep table (count=1); GPIO gate must skip, instead the header byte img[1]=2 is read as the VRHot DPM index
  pptable_init rc=0; gpio_table=skipped (baseline: parsed from the wrong table despite offset 0)
----- rc=0 -----
----- exit=0 -----
===== [FIXED] MODE vce-count-unclamped =====
DF-4388 rig: slice=pp_slice_fixed.inc mode=vce-count-unclamped
===== MODE vce-count-unclamped =====
  driving get_powerplay_table_entry_v1_0(0) with VCE ucNumEntries=200 (AMD_MAX_VCE_LEVELS=6)
amdgpu: [powerplay] Number of VCE state entries exceeds AMD_MAX_VCE_LEVELS! Disregarding the excess entries...
  rc=0; hwmgr->num_vce_state_tables STORED = 6 (vce_states[] holds 6)
----- rc=0 -----
----- exit=0 -----