⬢ DragonFlyBSD Kernel Audit
DF-5381 / panic.txt
← back to finding ↓ download raw
[DF5381] T6 PASS page-array walked 12 pages past a 2-page load; stale physaddr returned verbatim
[DF5381] RESULT 6/7 primitive tests passed
[DF5381] engine-allocated 32 x 200-byte DMA objects (page_offset_end=912)
[DF5381] neighbours pcA=0xfffff80116ef8200 pcB=0xfffff80116ef8400 chunk_gap=512 (object extent=200)
[DF5381] T1 PASS cross-object OOB READ (read pcB's bytes via pcA offset 512)
[DF5381] T2 PASS cross-object OOB WRITE (planted 16 bytes into pcB via pcA offset 512)
[DF5381] T2b PASS write past object extent offset=200 accepted (page_offset_end=912)
[DF5381] T3 PASS cross-object OOB ZERO via usbd_frame_zero
[DF5381] T4 stale kernel-heap bytes (chunk tail of pcB): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[DF5381] T4 INCONCLUSIVE zero bytes
[DF5381] T4b kernel-heap bytes behind freed chunk (kfree zeroed): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[DF5381] T5 get_page(offset=0xFFFFFF00) -> buffer=pcA0 length=0xffffffff (no bound)
[DF5381] T5 PASS engine hands out wild KVA +4GB-256 and length=UINT32_MAX
[DF5381] T6 get_page(multiseg, offset=49152) -> physaddr=0xdeadbeef0000 (loaded extent=8192 bytes) length=4096
[DF5381] T6 PASS page-array walked 12 pages past a 2-page load; stale physaddr returned verbatim
[DF5381] RESULT 6/7 primitive tests passed
[DF5381] engine-allocated 32 x 200-byte DMA objects (page_offset_end=1424)
[DF5381] neighbours pcA=0xfffff80117c2d400 pcB=0xfffff80117c2d600 chunk_gap=512 (object extent=200)
[DF5381] T1 PASS cross-object OOB READ (read pcB's bytes via pcA offset 512)
[DF5381] T2 PASS cross-object OOB WRITE (planted 16 bytes into pcB via pcA offset 512)
[DF5381] T2b PASS write past object extent offset=200 accepted (page_offset_end=1424)
[DF5381] T3 PASS cross-object OOB ZERO via usbd_frame_zero
[DF5381] T4 stale kernel-heap bytes (chunk tail of pcB): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[DF5381] T4 INCONCLUSIVE zero bytes
[DF5381] T4b kernel-heap bytes behind freed chunk (kfree zeroed): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[DF5381] T5 get_page(offset=0xFFFFFF00) -> buffer=pcA0 length=0xffffffff (no bound)
[DF5381] T5 PASS engine hands out wild KVA +4GB-256 and length=UINT32_MAX
[DF5381] T6 get_page(multiseg, offset=49152) -> physaddr=0xdeadbeef0000 (loaded extent=8192 bytes) length=4096
[DF5381] T6 PASS page-array walked 12 pages past a 2-page load; stale physaddr returned verbatim


Fatal trap 12: page fault while in kernel mode
cpuid = 4; lapic id = 4
fault virtual address	= 0xfffff8011863e000
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80bcabe5
stack pointer	        = 0x10:0xfffff80118633550
frame pointer	        = 0x10:0xfffff80118633598
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1119
current thread          = pri 6 
kernel: type 12 trap, code=0

CPU4 stopping CPUs: 0x0000002f
 stopped
Stopped at      memcpy+0x55:    movq    (%rsi),%rdx
db>