โฌข DragonFlyBSD Kernel Audit
DF-5073 / run.2.log
โ† back to finding โ†“ download raw
DF-5073 โ€” leak boot, unprivileged reader, process-level grooms
===============================================================

Boot command:
  cd dfbsd-qemu && QEMU_EXTRA="-acpitable file=ssdt_acad_leak.aml" ./vm.sh up 300

SSDT: ACPI0003 device PWRS whose _PSR evaluates OK but returns NO object
      (iasl warnings 3115/3107: "Not all control paths return a value",
       "Reserved method must return a value (Integer required for _PSR)").

Expected CORRECT behavior: acpi_GetInteger returns AE_TYPE-ish behavior,
newstatus stays -1, hw.acpi.acline reads -1 (or the init never succeeds).

OBSERVED: hw.acpi.acline reads 0 โ€” only reachable through the uninitialized
ACPI_OBJECT param path (param.Type residue == ACPI_TYPE_INTEGER(4),
param.Integer.Value residue low dword == 0).

Transcript (each command a separate process; grooms therefore land in other
kstacks โ€” same-thread grooming is in run.log):

  $ sysctl hw.acpi.acline            (as uid 1001 via ssh dfbsd-maxx)
  hw.acpi.acline: 0
  $ sysctl hw.acpi.acline
  hw.acpi.acline: 0
  (after `sysctl -a`, after `ls -lR /usr/include`, after `find / -maxdepth 3`:
   all reads still 0 โ€” see below)

  == baseline, no groom:      0
  == groom: sysctl -a:        0
  == groom: ls -lR /usr/include: 0
  == groom: find -name "*.conf": 0
  == groom: sysctl -a again:  0

Root-side dmesg on this boot:
  ACPI: SSDT 0x00000000BFFE1CAC 000050 (v02 DFACAD ACADSANE...)  <- (boot A)
  ACPI: SSDT 0x00000000BFFE1CAC 000053 (v02 DFACAD ACADLEAK 00000001 INTL 20251212)
  acpi_acad0: <AC Adapter> on acpi0