⬢ DragonFlyBSD Kernel Audit
DF-5303 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-5303",
  "title": "DUMPDMA ioctl channel-bound off-by-one: dump_db indexes ir[OHCI_DMA_IRCH] one past the array, type-confuses the softc tail and walks it as a descriptor ring (panic / console heap leak); dump_dma MMIO-reads past the register file",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh   (guest, root: builds the shared df5302.ko with the production fwohci.c)",
    "run": "sh run.sh     (kldload; sysctl kern.df5302_mode=2; sysctl kern.df5302_fire=1)",
    "expected": "Fatal trap 12, fault virtual address 0x10, supervisor read data, Stopped at dump_db+0x58: movq (%rax),%r9"
  },
  "kernel_refs": [
    "sys/bus/firewire/fwohci.c:372",
    "sys/bus/firewire/fwohci.c:2203",
    "sys/bus/firewire/fwohci.c:2261",
    "sys/bus/firewire/fwohci.c:2275",
    "sys/bus/firewire/fwohcireg.h:88",
    "sys/bus/firewire/fwohcivar.h:64"
  ],
  "artifacts": [
    "df5302.c", "Makefile", "build.sh", "run.sh",
    "build.log", "run.log", "panic.txt", "panic.first.txt",
    "fix.diff", "env.txt", "VERDICT.md", "verdict.json", "manifest.json"
  ]
}