⬢ DragonFlyBSD Kernel Audit
DF-5335 / run_patched.log
← back to finding ↓ download raw
=== DF-5335 fix validation (v3: sigreturn/set_regs SS+RSP gate + trap.c synthetic frame): kernel #4 02:14:57, unpriv maxx ===
[PATCHED-v3 v0 ss=0] -> handler: variant 0, returning into modified frame;Bus error (core dumped);exit=138;
[PATCHED-v3 v2 rsp-noncanon] -> handler: variant 2, returning into modified frame;Bus error (core dumped);exit=138;
[PATCHED-v3 v4 ss=0x1b] -> handler: variant 4, returning into modified frame;Bus error (core dumped);exit=138;
[PATCHED-v3 v7 ss=0x10] -> handler: variant 7, returning into modified frame;Bus error (core dumped);exit=138;
[PATCHED-v3 ss=0x1000] -> exit=138;Bus error (core dumped);
[PATCHED-v3 ss=0x4 FORMER-CRASH] -> Bus error (core dumped);exit=138;
[PATCHED-v3 ss=0x7 FORMER-CRASH] -> Bus error (core dumped);exit=138;
[PATCHED-v3 ss=0xdead FORMER-CRASH] -> Bus error (core dumped);exit=138;
[PATCHED-v3 ss=0x2b VALID] -> Bus error (core dumped);exit=138;
guest status after full matrix: up
uptime:  2:31AM  up 1 min, 0 users, load averages: 0.29, 0.10, 0.03
sigreturn rejections on console:
9
--- no-false-positive checks (same patched kernel) ---
SSVAL=0x23 (the real GSEL(GUDATA_SEL,SEL_UPL)=0x23 user data selector) /tmp/t8:
  SURVIVED ss=0x23 / exit=0        <- valid sigreturn unaffected
/tmp/iretbug 6 (no modification): SURVIVED, exit=0
normal signal delivery (/bin/sh kill -USR1), /bin/date, /bin/echo: all normal
dmesg "sigreturn: ss = " rejections on this boot: 9 (exactly the 9 bad values)