⬢ DragonFlyBSD Kernel Audit
DF-5305 / run.log
← back to finding ↓ download raw
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
HARNESS: loaded (real uvc sources compiled in)
HARNESS[1] DF-5305: parse_ctrl ret=0 sc.data=0xfffff8004f164300 blob=0xfffff8004f1839e0 blob_end=0xfffff8004f183a24
HARNESS[1] DF-5305: nfmt=1 nfrm=0 nitv=0 fmt=0xfffff8004f1ae0a0
HARNESS fmt[0].name hex:
  c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0
  55 55 55 55 55 55 55 00 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HARNESS[1] DF-5305: name strlen=23; in-bounds non-NUL run after GUID start (blob+45) is 23 bytes -> strlen > 23 PROVES read past the 68-byte cdesc allocation
HARNESS[1] DF-5305: uvc_drv_enum_v4l2_fmt ret=0 -> user-visible description=<M-AM-BM-CM-DM-EM-FM-GM-HM-IM-JM-KM-LM-MM-NM-OM-PUUUUUUU>
HARNESS: unloaded
malloc_uninit: 224 bytes of 'uvc' still allocated on cpu 6
HARNESS: loaded (real uvc sources compiled in)
HARNESS[1] DF-5305: parse_ctrl ret=0 sc.data=0xfffff8004f164338 blob=0xfffff8004f183ea8 blob_end=0xfffff8004f183ef0
HARNESS[1] DF-5305: nfmt=1 nfrm=0 nitv=0 fmt=0xfffff8004f1ae100
HARNESS fmt[0].name hex:
  c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0
  55 55 55 55 55 55 55 5a 5a 5a 5a 43 43 43 43 43
  43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43
  43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 00
HARNESS[1] DF-5305: name strlen=63; in-bounds non-NUL run after GUID start (blob+45) is 27 bytes -> strlen > 27 PROVES read past the 72-byte cdesc allocation (groom marker this round = 0x43)
HARNESS[1] DF-5305: *** OOB READ PAST ALLOCATION CONFIRMED: 36 bytes from outside the blob ***
HARNESS[1] DF-5305: uvc_drv_enum_v4l2_fmt ret=0 -> user-visible description=<M-AM-BM-CM-DM-EM-FM-GM-HM-IM-JM-KM-LM-MM-NM-OM-PUUUUUUUZZZZCCCC>
HARNESS[2] DF-5305: parse_ctrl ret=0 sc.data=0xfffff8004f164370 blob=0xfffff8004f183f80 blob_end=0xfffff8004f183fc8
HARNESS[2] DF-5305: nfmt=1 nfrm=0 nitv=0 fmt=0xfffff8004f1ae160
HARNESS fmt[0].name hex:
  c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0
  55 55 55 55 55 55 55 5a 5a 5a 5a 45 45 45 45 45
  45 45 45 45 45 45 45 45 45 45 45 45 45 45 45 45
  45 45 45 45 45 45 45 45 45 45 45 45 45 45 45 00
HARNESS[2] DF-5305: name strlen=63; in-bounds non-NUL run after GUID start (blob+45) is 27 bytes -> strlen > 27 PROVES read past the 72-byte cdesc allocation (groom marker this round = 0x45)
HARNESS[2] DF-5305: *** OOB READ PAST ALLOCATION CONFIRMED: 36 bytes from outside the blob ***
HARNESS[2] DF-5305: uvc_drv_enum_v4l2_fmt ret=0 -> user-visible description=<M-AM-BM-CM-DM-EM-FM-GM-HM-IM-JM-KM-LM-MM-NM-OM-PUUUUUUUZZZZEEEE>
HARNESS[3] DF-5305: parse_ctrl ret=0 sc.data=0xfffff8004f1643a8 blob=0xfffff8004f184058 blob_end=0xfffff8004f1840a0
HARNESS[3] DF-5305: nfmt=1 nfrm=0 nitv=0 fmt=0xfffff8004f1ae1c0
HARNESS fmt[0].name hex:
  c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0
  55 55 55 55 55 55 55 5a 5a 5a 5a 47 47 47 47 47
  47 47 47 47 47 47 47 47 47 47 47 47 47 47 47 47
  47 47 47 47 47 47 47 47 47 47 47 47 47 47 47 00
HARNESS[3] DF-5305: name strlen=63; in-bounds non-NUL run after GUID start (blob+45) is 27 bytes -> strlen > 27 PROVES read past the 72-byte cdesc allocation (groom marker this round = 0x47)
HARNESS[3] DF-5305: *** OOB READ PAST ALLOCATION CONFIRMED: 36 bytes from outside the blob ***
HARNESS[3] DF-5305: uvc_drv_enum_v4l2_fmt ret=0 -> user-visible description=<M-AM-BM-CM-DM-EM-FM-GM-HM-IM-JM-KM-LM-MM-NM-OM-PUUUUUUUZZZZGGGG>