⬢ DragonFlyBSD Kernel Audit
DF-4686 / fix_validate.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
#!/bin/sh
# DF-4686 / DF-4687 / DF-4688 / DF-4689 fix validation (guest).
# Applies each fix to a copy of the pristine guest ar2425.c,
# re-extracts the (patched) function bodies verbatim, rebuilds the
# harness against them and re-runs the affected mode(s).
# Success criteria:
#   fixA (DF-4687): mode 1 -> NO overflow past pcdacTable[128]
#   fixB (DF-4688): mode 2 -> early return, no 0x5A5A propagation,
#                   sentinel minPower untouched
#   fixC (DF-4689): mode 3 -> completes without the wild SIGSEGV
#   fixD+fixB (DF-4686): mode 5 -> completes with fixD alone when a
#                   legal gain remains is NOT the case here (fixD skips
#                   the span-102 gain => zero gains remain => fixB's
#                   early return covers that residual path); mode 4 same.
set -e
cd /root/df2425

extract() {
	awk '
	  !f && /^GetLowerUpperIndex\(int16_t v/ { print prev; f=1 }
	  f { print; if ($0 ~ /"<==%s/) { getline; print; exit } }
	  { prev = $0 }
	' "$1" > ar2425_extracted.raw
	sed -E '/^[[:space:]]*static[[:space:]]+(uint16_t[[:space:]]+VpdTable_[LRI]\[|int16_t[[:space:]]+P(min|max)_t2\[)/d' \
	    ar2425_extracted.raw > ar2425_extracted.inc
	raw=$(wc -l < ar2425_extracted.raw); inc=$(wc -l < ar2425_extracted.inc)
	echo "extract: removed $((raw-inc)) static lines (must be 5)"
	[ "$((raw-inc))" -eq 5 ] || { echo STRIP_MISMATCH; exit 1; }
	cc -O2 -Wall -Wno-pointer-sign -o ar2425_harness_fixed ar2425_harness.c
	echo FIXED_BUILD_OK
}

echo "===== fixA (DF-4687 kk guards) ====="
cp ar2425_src.c ar2425_fixed.c
patch -p1 ar2425_fixed.c < fixA.diff
echo PATCHES_APPLIED
extract ar2425_fixed.c
echo "--- PATCHED mode 1 (expect: NO overflow) ---"
./ar2425_harness_fixed 1 || echo "exit=$? (1 == no overflow detected = FIXED)"

echo "===== fixB (DF-4688 zero-gain early return) ====="
cp ar2425_src.c ar2425_fixed.c
patch -p1 ar2425_fixed.c < fixB.diff
echo PATCHES_APPLIED
extract ar2425_fixed.c
echo "--- PATCHED mode 2 (expect: early return, no 0x5A5A, sentinel minPower) ---"
./ar2425_harness_fixed 2 || echo "exit=$?"

echo "===== fixC (DF-4689 flat-curve guards) ====="
cp ar2425_src.c ar2425_fixed.c
patch -p1 ar2425_fixed.c < fixC.diff
echo PATCHES_APPLIED
extract ar2425_fixed.c
echo "--- PATCHED mode 3 (expect: completes, no SIGSEGV at wild address) ---"
./ar2425_harness_fixed 3 || echo "exit=$? (1 == no fault = FIXED)"

echo "===== fixD (DF-4686 span rejection) alone: residual zero-gain path ====="
cp ar2425_src.c ar2425_fixed.c
patch -p1 ar2425_fixed.c < fixD.diff
echo PATCHES_APPLIED
extract ar2425_fixed.c
echo "--- PATCHED mode 5 with fixD only (expect: SIGSEGV wild read = DF-4688 residual) ---"
./ar2425_harness_fixed 5 || echo "exit=$? (residual: skipping the gain leaves zero gains -> fixB needed)"

echo "===== fixD + fixB (DF-4686 complete) ====="
cp ar2425_src.c ar2425_fixed.c
patch -p1 ar2425_fixed.c < fixD.diff
patch -p1 ar2425_fixed.c < fixB.diff
echo PATCHES_APPLIED
extract ar2425_fixed.c
echo "--- PATCHED mode 4 with fixB+fixD (expect: completes) ---"
./ar2425_harness_fixed 4 || echo "exit=$? (1 == no fault = FIXED)"
echo "--- PATCHED mode 5 with fixB+fixD (expect: completes) ---"
./ar2425_harness_fixed 5 || echo "exit=$? (1 == no fault = FIXED)"
echo "--- PATCHED mode 1/2/3 sanity with fixB+fixD ---"
./ar2425_harness_fixed 1 || true
./ar2425_harness_fixed 2 || true
./ar2425_harness_fixed 3 || true