⬢ DragonFlyBSD Kernel Audit
DF-4951 / run.log
← back to finding ↓ download raw
BUILD_RC=0
DF-4951 lifted-copy harness: vega12 double pptable_fini NULL deref
phm_ppt_v3_information.power_saving_clock_max offset = 16 (kernel x86-64: 16)

== CASE 1 BOOT-OK (healthy reset) ==
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    [user ] root writes pp_table #1 (healthy)
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    amd_powerplay_reset #1 -> ok (0), hwmgr->pptable now non-NULL
    [user ] root writes pp_table #2 / driver teardown -> hwmgr_hw_fini
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    amd_powerplay_reset #2 -> ok (0) (unreached on fault)
    case 1 BOOT-OK (healthy reset) survived; alloc balance this case: +6 (kernel: leaked phm_ppt_v3_information + members on error paths)
    case 1 BOOT-OK (healthy reset): child clean exit 0

== CASE 2 BUG: write1 backend-fail + write2 ==
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    [user ] root writes pp_table #1 (valid hdr, backend fails)
    amd_powerplay_reset #1 -> FAIL (-22), hwmgr->pptable now NULL
    [user ] root writes pp_table #2 / driver teardown -> hwmgr_hw_fini
>>> SIGSEGV: fault address 0x10 (power_saving_clock_max = pptable + 0x10)
>>> faulting RIP context ucontext=0x7fffffdfd0c0 -- kernel equivalent: kfree(NULL->power_saving_clock_max) in vega12_pp_tables_uninitialize (vega12_processpptables.c:301)
>>> PANIC-CLASS FAULT REPRODUCED (case 2 BUG: write1 backend-fail + write2)
    case 2 BUG: write1 backend-fail + write2: child _exit(99) PANIC-CLASS FAULT

== CASE 3 CONTROL-LEAK: write1 bad-header + write2 ==
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    [user ] root writes pp_table #1 (bad header)
    [kernel] "Unsupported PPTable format!"
    amd_powerplay_reset #1 -> FAIL (-1), hwmgr->pptable now non-NULL
    [user ] root writes pp_table #2 / driver teardown -> hwmgr_hw_fini
    [kernel] dpm fully enabled (pm.dpm_enabled = true)
    amd_powerplay_reset #2 -> ok (0) (unreached on fault)
    case 3 CONTROL-LEAK: write1 bad-header + write2 survived; alloc balance this case: +6 (kernel: leaked phm_ppt_v3_information + members on error paths)
    case 3 CONTROL-LEAK: write1 bad-header + write2: child clean exit 0

RUN_RC=0