⬢ DragonFlyBSD Kernel Audit
DF-5083 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "verdict": "reproduced",
  "impact": "dos",
  "finding_id": "DF-5083",
  "reproduce": {
    "build": "cd /root/df5083 && sh build.sh   (make KLD df5083 + cc straddle.c; needs /usr/src/sys in guest)",
    "run": "kldload /root/df5083/df5083.ko ; sleep 8 ; dmesg | grep DF5083   (guest RAM must exceed the bounce threshold region; stock 4608MB config used)",
    "expected": "DEMO F: 0/16 deferred on fixed geometry; DEMO C: 'CHANNEL WEDGED FOREVER'; DEMO A/B: '*** DEFERRED busdma_swi CALLBACK FIRED into DEAD FRAME ***' with PRD entries written through the stale &dmatab word (marker[..] = phys:00001000 lines), or Fatal trap 12 supervisor-write at po_setprd+0x48 with current process = Idle when the stale word holds garbage"
  },
  "kernel_refs": [
    "sys/dev/disk/nata/ata-dma.c:223",
    "sys/dev/disk/nata/ata-dma.c:251",
    "sys/dev/disk/nata/ata-dma.c:254",
    "sys/dev/disk/nata/ata-dma.c:199",
    "sys/dev/disk/nata/ata-dma.c:210",
    "sys/dev/disk/nata/ata-dma.c:109",
    "sys/dev/disk/nata/ata-lowlevel.c:126",
    "sys/dev/disk/nata/ata-lowlevel.c:208",
    "sys/platform/pc64/x86_64/busdma_machdep.c:776",
    "sys/platform/pc64/x86_64/busdma_machdep.c:645",
    "sys/platform/pc64/x86_64/busdma_machdep.c:793",
    "sys/platform/pc64/x86_64/busdma_machdep.c:1437",
    "sys/platform/pc64/x86_64/busdma_machdep.c:1086",
    "sys/platform/pc64/x86_64/busdma_machdep.c:401"
  ],
  "artifacts": [
    "df5083.c", "Makefile", "straddle.c", "build.sh", "run.sh",
    "build.log", "run.log", "run1.out", "run.2.log", "run.3.log",
    "panic-run-B.txt", "env.txt", "code_hash.txt", "fix.diff",
    "VERDICT.md", "manifest.json", "verdict.json"
  ]
}