⬢ DragonFlyBSD Kernel Audit
DF-4951 / fix_run.log
← back to finding ↓ download raw
PATCHED_BUILD_RC=0
DF-4951 lifted-copy harness: vega12 double pptable_fini NULL deref
phm_ppt_v3_information.power_saving_clock_max offset = 16 (kernel x86-64: 16)

== CASE 1 BOOT-OK (healthy reset) ==
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    [user ] root writes pp_table #1 (healthy)
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    amd_powerplay_reset #1 -> ok (0), hwmgr->pptable now non-NULL
    [user ] root writes pp_table #2 / driver teardown -> hwmgr_hw_fini
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    amd_powerplay_reset #2 -> ok (0) (unreached on fault)
    case 1 BOOT-OK (healthy reset) survived; alloc balance this case: +6 (kernel: leaked phm_ppt_v3_information + members on error paths)
    case 1 BOOT-OK (healthy reset): child clean exit 0

== CASE 2 BUG: write1 backend-fail + write2 ==
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    [user ] root writes pp_table #1 (valid hdr, backend fails)
    amd_powerplay_reset #1 -> FAIL (-22), hwmgr->pptable now NULL
    [user ] root writes pp_table #2 / driver teardown -> hwmgr_hw_fini
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    amd_powerplay_reset #2 -> ok (0) (unreached on fault)
    case 2 BUG: write1 backend-fail + write2 survived; alloc balance this case: +6 (kernel: leaked phm_ppt_v3_information + members on error paths)
    case 2 BUG: write1 backend-fail + write2: child clean exit 0

== CASE 3 CONTROL-LEAK: write1 bad-header + write2 ==
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    [user ] root writes pp_table #1 (bad header)
    [kernel] "Unsupported PPTable format!"
    amd_powerplay_reset #1 -> FAIL (-1), hwmgr->pptable now non-NULL
    [user ] root writes pp_table #2 / driver teardown -> hwmgr_hw_fini
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    amd_powerplay_reset #2 -> ok (0) (unreached on fault)
    case 3 CONTROL-LEAK: write1 bad-header + write2 survived; alloc balance this case: +6 (kernel: leaked phm_ppt_v3_information + members on error paths)
    case 3 CONTROL-LEAK: write1 bad-header + write2: child clean exit 0

(PATCHED build: NULL guard active -- case 2 must survive)
== CASE 4 PATCHED: write1 backend-fail + write2 ==
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    [user ] root writes pp_table #1 (valid hdr, backend fails)
    amd_powerplay_reset #1 -> FAIL (-22), hwmgr->pptable now NULL
    [user ] root writes pp_table #2 / driver teardown -> hwmgr_hw_fini
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    amd_powerplay_reset #2 -> ok (0) (unreached on fault)
    case 4 PATCHED: write1 backend-fail + write2 survived; alloc balance this case: +6 (kernel: leaked phm_ppt_v3_information + members on error paths)
    case 4 PATCHED: write1 backend-fail + write2: child clean exit 0

PATCHED_RUN_RC=0