⬢ DragonFlyBSD Kernel Audit
DF-5008 / model_run.log
← back to finding ↓ download raw 
== default attack: alignment=3MB (non-pow2, > 2MB default amdgpu_vram_page_split), size=3MB ==
[*] AMDGPU_GEM_CREATE in.alignment=3145728 (NOT pow2), in.size=3145728, VRAM=1048576 pages
  num_pages=768 page_alignment=768 -> pages_per_node=768 (pow2=0) num_nodes=1
  loop1: nodes[0] size=512 align=768 start=0
  loop2: nodes[1] size=256 align=768 start=768
  [!!] OOB: highest node index written = 1, num_nodes = 1 -> nodes[1] is OUT OF BOUNDS
  [!!] kvmalloc_array(1, 160) = 160 bytes; drm_mm writes sizeof(drm_mm_node)=160 bytes at offset 160 (node .mm/.start/.size/.color/.node_list/...)
  [!!] net overflow past end of allocation: 160 bytes of kernel heap corrupted, then linked into the live drm_mm (list_add/rb insert, drm_mm.c:556-570)

== sweep: pow2 vs non-pow2 alignments, size == alignment ==
[*] AMDGPU_GEM_CREATE in.alignment=1048576 (pow2), in.size=1048576, VRAM=1048576 pages
  num_pages=256 page_alignment=256 -> pages_per_node=512 (pow2=1) num_nodes=1
  loop2: nodes[0] size=256 align=256 start=0
  -> OK: highest index 0 < num_nodes 1 (no OOB)

[*] AMDGPU_GEM_CREATE in.alignment=1572864 (NOT pow2), in.size=1572864, VRAM=1048576 pages
  num_pages=384 page_alignment=384 -> pages_per_node=512 (pow2=1) num_nodes=1
  loop2: nodes[0] size=384 align=384 start=0
  -> OK: highest index 0 < num_nodes 1 (no OOB)

[*] AMDGPU_GEM_CREATE in.alignment=2097152 (pow2), in.size=2097152, VRAM=1048576 pages
  num_pages=512 page_alignment=512 -> pages_per_node=512 (pow2=1) num_nodes=1
  loop1: nodes[0] size=512 align=512 start=0
  -> OK: highest index 0 < num_nodes 1 (no OOB)

[*] AMDGPU_GEM_CREATE in.alignment=2621440 (NOT pow2), in.size=2621440, VRAM=1048576 pages
  num_pages=640 page_alignment=640 -> pages_per_node=640 (pow2=0) num_nodes=1
  loop1: nodes[0] size=512 align=640 start=0
  loop2: nodes[1] size=128 align=640 start=640
  [!!] OOB: highest node index written = 1, num_nodes = 1 -> nodes[1] is OUT OF BOUNDS
  [!!] kvmalloc_array(1, 160) = 160 bytes; drm_mm writes sizeof(drm_mm_node)=160 bytes at offset 160 (node .mm/.start/.size/.color/.node_list/...)
  [!!] net overflow past end of allocation: 160 bytes of kernel heap corrupted, then linked into the live drm_mm (list_add/rb insert, drm_mm.c:556-570)

[*] AMDGPU_GEM_CREATE in.alignment=3145728 (NOT pow2), in.size=3145728, VRAM=1048576 pages
  num_pages=768 page_alignment=768 -> pages_per_node=768 (pow2=0) num_nodes=1
  loop1: nodes[0] size=512 align=768 start=0
  loop2: nodes[1] size=256 align=768 start=768
  [!!] OOB: highest node index written = 1, num_nodes = 1 -> nodes[1] is OUT OF BOUNDS
  [!!] kvmalloc_array(1, 160) = 160 bytes; drm_mm writes sizeof(drm_mm_node)=160 bytes at offset 160 (node .mm/.start/.size/.color/.node_list/...)
  [!!] net overflow past end of allocation: 160 bytes of kernel heap corrupted, then linked into the live drm_mm (list_add/rb insert, drm_mm.c:556-570)

[*] AMDGPU_GEM_CREATE in.alignment=3670016 (NOT pow2), in.size=3670016, VRAM=1048576 pages
  num_pages=896 page_alignment=896 -> pages_per_node=896 (pow2=0) num_nodes=1
  loop1: nodes[0] size=512 align=896 start=0
  loop2: nodes[1] size=384 align=896 start=896
  [!!] OOB: highest node index written = 1, num_nodes = 1 -> nodes[1] is OUT OF BOUNDS
  [!!] kvmalloc_array(1, 160) = 160 bytes; drm_mm writes sizeof(drm_mm_node)=160 bytes at offset 160 (node .mm/.start/.size/.color/.node_list/...)
  [!!] net overflow past end of allocation: 160 bytes of kernel heap corrupted, then linked into the live drm_mm (list_add/rb insert, drm_mm.c:556-570)

[*] AMDGPU_GEM_CREATE in.alignment=4194304 (pow2), in.size=4194304, VRAM=1048576 pages
  num_pages=1024 page_alignment=1024 -> pages_per_node=1024 (pow2=1) num_nodes=1
  loop1: nodes[0] size=1024 align=1024 start=0
  -> OK: highest index 0 < num_nodes 1 (no OOB)

[*] AMDGPU_GEM_CREATE in.alignment=4718592 (NOT pow2), in.size=4718592, VRAM=1048576 pages
  num_pages=1152 page_alignment=1152 -> pages_per_node=1152 (pow2=0) num_nodes=1
  loop1: nodes[0] size=1024 align=1152 start=0
  loop2: nodes[1] size=128 align=1152 start=1152
  [!!] OOB: highest node index written = 1, num_nodes = 1 -> nodes[1] is OUT OF BOUNDS
  [!!] kvmalloc_array(1, 160) = 160 bytes; drm_mm writes sizeof(drm_mm_node)=160 bytes at offset 160 (node .mm/.start/.size/.color/.node_list/...)
  [!!] net overflow past end of allocation: 160 bytes of kernel heap corrupted, then linked into the live drm_mm (list_add/rb insert, drm_mm.c:556-570)

[*] AMDGPU_GEM_CREATE in.alignment=5242880 (NOT pow2), in.size=5242880, VRAM=1048576 pages
  num_pages=1280 page_alignment=1280 -> pages_per_node=1280 (pow2=0) num_nodes=1
  loop1: nodes[0] size=1024 align=1280 start=0
  loop2: nodes[1] size=256 align=1280 start=1280
  [!!] OOB: highest node index written = 1, num_nodes = 1 -> nodes[1] is OUT OF BOUNDS
  [!!] kvmalloc_array(1, 160) = 160 bytes; drm_mm writes sizeof(drm_mm_node)=160 bytes at offset 160 (node .mm/.start/.size/.color/.node_list/...)
  [!!] net overflow past end of allocation: 160 bytes of kernel heap corrupted, then linked into the live drm_mm (list_add/rb insert, drm_mm.c:556-570)

[*] AMDGPU_GEM_CREATE in.alignment=5767168 (NOT pow2), in.size=5767168, VRAM=1048576 pages
  num_pages=1408 page_alignment=1408 -> pages_per_node=1408 (pow2=0) num_nodes=1
  loop1: nodes[0] size=1024 align=1408 start=0
  loop2: nodes[1] size=384 align=1408 start=1408
  [!!] OOB: highest node index written = 1, num_nodes = 1 -> nodes[1] is OUT OF BOUNDS
  [!!] kvmalloc_array(1, 160) = 160 bytes; drm_mm writes sizeof(drm_mm_node)=160 bytes at offset 160 (node .mm/.start/.size/.color/.node_list/...)
  [!!] net overflow past end of allocation: 160 bytes of kernel heap corrupted, then linked into the live drm_mm (list_add/rb insert, drm_mm.c:556-570)

[*] AMDGPU_GEM_CREATE in.alignment=6291456 (NOT pow2), in.size=6291456, VRAM=1048576 pages
  num_pages=1536 page_alignment=1536 -> pages_per_node=1536 (pow2=0) num_nodes=1
  loop1: nodes[0] size=1024 align=1536 start=0
  loop2: nodes[1] size=512 align=1536 start=1536
  [!!] OOB: highest node index written = 1, num_nodes = 1 -> nodes[1] is OUT OF BOUNDS
  [!!] kvmalloc_array(1, 160) = 160 bytes; drm_mm writes sizeof(drm_mm_node)=160 bytes at offset 160 (node .mm/.start/.size/.color/.node_list/...)
  [!!] net overflow past end of allocation: 160 bytes of kernel heap corrupted, then linked into the live drm_mm (list_add/rb insert, drm_mm.c:556-570)

[*] AMDGPU_GEM_CREATE in.alignment=6815744 (NOT pow2), in.size=6815744, VRAM=1048576 pages
  num_pages=1664 page_alignment=1664 -> pages_per_node=1664 (pow2=0) num_nodes=1
  loop1: nodes[0] size=1024 align=1664 start=0
  loop2: nodes[1] size=640 align=1664 start=1664
  [!!] OOB: highest node index written = 1, num_nodes = 1 -> nodes[1] is OUT OF BOUNDS
  [!!] kvmalloc_array(1, 160) = 160 bytes; drm_mm writes sizeof(drm_mm_node)=160 bytes at offset 160 (node .mm/.start/.size/.color/.node_list/...)
  [!!] net overflow past end of allocation: 160 bytes of kernel heap corrupted, then linked into the live drm_mm (list_add/rb insert, drm_mm.c:556-570)

[*] AMDGPU_GEM_CREATE in.alignment=7340032 (NOT pow2), in.size=7340032, VRAM=1048576 pages
  num_pages=1792 page_alignment=1792 -> pages_per_node=1792 (pow2=0) num_nodes=1
  loop1: nodes[0] size=1024 align=1792 start=0
  loop2: nodes[1] size=768 align=1792 start=1792
  [!!] OOB: highest node index written = 1, num_nodes = 1 -> nodes[1] is OUT OF BOUNDS
  [!!] kvmalloc_array(1, 160) = 160 bytes; drm_mm writes sizeof(drm_mm_node)=160 bytes at offset 160 (node .mm/.start/.size/.color/.node_list/...)
  [!!] net overflow past end of allocation: 160 bytes of kernel heap corrupted, then linked into the live drm_mm (list_add/rb insert, drm_mm.c:556-570)

[*] AMDGPU_GEM_CREATE in.alignment=7864320 (NOT pow2), in.size=7864320, VRAM=1048576 pages
  num_pages=1920 page_alignment=1920 -> pages_per_node=1920 (pow2=0) num_nodes=1
  loop1: nodes[0] size=1024 align=1920 start=0
  loop2: nodes[1] size=896 align=1920 start=1920
  [!!] OOB: highest node index written = 1, num_nodes = 1 -> nodes[1] is OUT OF BOUNDS
  [!!] kvmalloc_array(1, 160) = 160 bytes; drm_mm writes sizeof(drm_mm_node)=160 bytes at offset 160 (node .mm/.start/.size/.color/.node_list/...)
  [!!] net overflow past end of allocation: 160 bytes of kernel heap corrupted, then linked into the live drm_mm (list_add/rb insert, drm_mm.c:556-570)

[*] AMDGPU_GEM_CREATE in.alignment=8388608 (pow2), in.size=8388608, VRAM=1048576 pages
  num_pages=2048 page_alignment=2048 -> pages_per_node=2048 (pow2=1) num_nodes=1
  loop1: nodes[0] size=2048 align=2048 start=0
  -> OK: highest index 0 < num_nodes 1 (no OOB)