DF-4682 / fix_run.log
===== fixA (DF-4680 kk guards) =====
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
--------------------------
Patching file ar2317_fixed.c using Plan A...
Hunk #1 succeeded at 429.
Hunk #2 succeeded at 440.
Hunk #3 succeeded at 451.
done
PATCHES_APPLIED
251 ar2317_extracted.inc
In file included from ar2317_harness.c:169:
ar2317_extracted.inc: In function 'ar2317FillVpdTable':
ar2317_extracted.inc:51:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
uint16_t ii, jj, kk;
^~
ar2317_harness.c: In function 'main':
ar2317_harness.c:337:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
*(uint16_t *)((char *)harness_priv->pcdacTable +
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x1FFFFFFFEull) = 0x5A5A;
~~~~~~~~~~~~~~~
FIXED_BUILD_OK
--- PATCHED mode 1 (expect: NO overflow) ---
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
mode=1 numPdGainsUsed(ret)=4 minPower=0x0000
DF-4680: NO overflow detected
exit=1 (1 == no overflow detected = FIXED)
===== fixB (DF-4681 zero-gain early return) =====
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
--------------------------
Patching file ar2317_fixed.c using Plan A...
Hunk #1 succeeded at 402.
Hunk #2 succeeded at 516.
done
PATCHES_APPLIED
252 ar2317_extracted.inc
In file included from ar2317_harness.c:169:
ar2317_extracted.inc: In function 'ar2317FillVpdTable':
ar2317_extracted.inc:51:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
uint16_t ii, jj, kk;
^~
ar2317_harness.c: In function 'main':
ar2317_harness.c:337:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
*(uint16_t *)((char *)harness_priv->pcdacTable +
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x1FFFFFFFEull) = 0x5A5A;
~~~~~~~~~~~~~~~
FIXED_BUILD_OK
--- PATCHED mode 2 (expect: ret=0, no 0x5A5A propagation, sentinel minPower) ---
mapped wild pages 0xa00490000 0xa00475000, seeded 0x5A5A
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
mode=2 numPdGainsUsed(ret)=0 minPower=0x7c7c
gainBoundaries[0] = 0x0000 (== 0x5A5A => wild read at gb+0x1FFFFFFFE, ar2317.c:465, then written to TPCRG5 by ar2317SetPowerTable:575-580)
pcdacTable[0] = 0xaaaa (== 0x5A5A => wild read at pcdacTable+0x1FFFFFFFE, ar2317.c:469, replicated across the pdadc table / 32 PHY reg writes)
minPower out = 0x7c7c (uninitialized Pmin_t2[0] stack read at ar2317.c:405; dataset carries no power data)
exit=1
===== fixC (DF-4682 flat-curve guards) =====
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
--------------------------
Patching file ar2317_fixed.c using Plan A...
Hunk #1 succeeded at 442.
done
PATCHES_APPLIED
256 ar2317_extracted.inc
In file included from ar2317_harness.c:169:
ar2317_extracted.inc: In function 'ar2317FillVpdTable':
ar2317_extracted.inc:51:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
uint16_t ii, jj, kk;
^~
ar2317_harness.c: In function 'main':
ar2317_harness.c:337:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
*(uint16_t *)((char *)harness_priv->pcdacTable +
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x1FFFFFFFEull) = 0x5A5A;
~~~~~~~~~~~~~~~
FIXED_BUILD_OK
--- PATCHED mode 3 (expect: completes, no SIGSEGV at wild address) ---
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
mode=3 numPdGainsUsed(ret)=4 minPower=0x003e
no SIGSEGV: function completed on this build
exit=1 (1 == no fault = FIXED)
===== fixD (DF-4683 span clamp) =====
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
--------------------------
Patching file ar2317_fixed.c using Plan A...
Hunk #1 succeeded at 380.
done
PATCHES_APPLIED
258 ar2317_extracted.inc
In file included from ar2317_harness.c:169:
ar2317_extracted.inc: In function 'ar2317FillVpdTable':
ar2317_extracted.inc:51:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
uint16_t ii, jj, kk;
^~
ar2317_harness.c: In function 'main':
ar2317_harness.c:337:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
*(uint16_t *)((char *)harness_priv->pcdacTable +
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x1FFFFFFFEull) = 0x5A5A;
~~~~~~~~~~~~~~~
FIXED_BUILD_OK
--- PATCHED mode 5 with fixD only (expect: completes) ---
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
mode=5 numPdGainsUsed(ret)=3 minPower=0x003a
no SIGSEGV: function completed on this build
exit=1 (1 == no fault = FIXED)
===== fixD + fixB (DF-4683 mode 4 residual zero-gain path) =====
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
--------------------------
Patching file ar2317_fixed.c using Plan A...
Hunk #1 succeeded at 380.
done
Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
|+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2317.c
--------------------------
Patching file ar2317_fixed.c using Plan A...
Hunk #1 succeeded at 410 (offset 8 lines).
Hunk #2 succeeded at 524 (offset 8 lines).
done
PATCHES_APPLIED
260 ar2317_extracted.inc
In file included from ar2317_harness.c:169:
ar2317_extracted.inc: In function 'ar2317FillVpdTable':
ar2317_extracted.inc:51:15: warning: variable 'jj' set but not used [-Wunused-but-set-variable]
uint16_t ii, jj, kk;
^~
ar2317_harness.c: In function 'main':
ar2317_harness.c:337:3: warning: array subscript 4294967295 is above array bounds of 'uint16_t[128]' {aka 'short unsigned int[128]'} [-Warray-bounds]
*(uint16_t *)((char *)harness_priv->pcdacTable +
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x1FFFFFFFEull) = 0x5A5A;
~~~~~~~~~~~~~~~
FIXED_BUILD_OK
--- PATCHED mode 4 with fixB+fixD (expect: completes) ---
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
mode=4 numPdGainsUsed(ret)=0 minPower=0x7c7c
no SIGSEGV: function completed on this build
exit=1 (1 == no fault = FIXED)
--- PATCHED mode 1/2/3 sanity with fixB+fixD ---
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
mode=1 numPdGainsUsed(ret)=4 minPower=0x0000
DF-4680 REPRODUCED: pPDADCValues write walked past pcdacTable[127]: first clobbered u16 cell 0 bytes past array end, last 79 bytes past (value 0x007f) => kk ran to 168
=> intra-object heap OOB WRITE past pcdacTable[PWR_TABLE_SIZE_2317=128] into Bank data (reprogrammed to the radio at ar2317.c:190-194)
mapped wild pages 0xa00490000 0xa00475000, seeded 0x5A5A
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
mode=2 numPdGainsUsed(ret)=0 minPower=0x7c7c
gainBoundaries[0] = 0x0000 (== 0x5A5A => wild read at gb+0x1FFFFFFFE, ar2317.c:465, then written to TPCRG5 by ar2317SetPowerTable:575-580)
pcdacTable[0] = 0xaaaa (== 0x5A5A => wild read at pcdacTable+0x1FFFFFFFE, ar2317.c:469, replicated across the pdadc table / 32 PHY reg writes)
minPower out = 0x7c7c (uninitialized Pmin_t2[0] stack read at ar2317.c:405; dataset carries no power data)
sizeof(struct ar2317State)=2008 offsetof(pcdacTable)=72 Bank1Data=328 vpdTable_L=472 vpdTable_I=1496 guard=0x800476000
REPRODUCED: SIGSEGV si_addr=0xa00475dfe
expected wild READ address 0xa00475dfe (uint32 index wrap: element index 0xFFFFFFFF x sizeof(uint16_t)=2 => +0x1FFFFFFFE bytes = +8.59 GB)
MATCH: wild OOB read proven (ar2317.c uint32 counter underflow)