⬢ DragonFlyBSD Kernel Audit
DF-4754 / fix_run.log
← back to finding ↓ download raw
DF4754: [1] TX contrast: device req_id IS validated (ena_eth_com.c:614)
DF4754: tx_comp_req_id_get(req_id=0xffff) rc=22 (EINVAL=22) -> REJECTED by bounds check
DF4754: [2] RX path: same device req_id, NO validation (ena_eth_com.c:540)
DF4754: ena_com_rx_pkt rc=22 descs=0
DF4754: ena_bufs[0].len=0x0000 ena_bufs[0].req_id=0x0000 rejected
DF4754: [3] driver consumer (ena.c:1459): rx_buffer_info[req_id]
DF4754: rx_buffer_info=0xfffff80118450000 (1024 entries, 65536 bytes, ena.c:736)
DF4754: ena.c:1459 rx_info = &rx_buffer_info[0x0000] -> 0xfffff80118450000  (-64 KB past ring end)
DF4754: OOB read rx_info->mbuf         = 0  (wild mbuf*)
DF4754: OOB read rx_info->ena_buf.paddr = 0x0000000000000000
DF4754: RESULT: hostile cdesc req_id reached driver indexing OOB
DF4754: harness complete