⬢ DragonFlyBSD Kernel Audit
DF-5434 / fix_run.log
← back to finding ↓ download raw
HARNESS DF-5434[A1]: marker=0x5a round start
HARNESS DF-5434[A1]: req1 -> mem=0xfffff80118380000 count=4 size=0x10000
HARNESS DF-5434[A1]: after sell1 buf3: mem=0xfffff80118380000 offset=0x30000 bytesused=0x1000 status=2 (still linked as product head)
HARNESS DF-5434[A1]: req2(count=1) -> NEW mem=0xfffff80118380000 (OLD mem=0xfffff80118380000 was kfree'd; buf3 NOT re-inited: mem=0 status=0 bytesused=0x0; product head=0 == buf3? no)
HARNESS DF-5434[A1]: victim=0xfffff80118390000 (reclaimed old mem? no)
HARNESS DF-5434[A1]: after sell2 (wrote 0xa5 x 0x800 at OLDmem+3*0x10000+0x1000)
HARNESS DF-5434[A1]: no hit: found 0 bytes of 0xa5 pattern inside freed/reclaimed block 0xfffff80118380000 (expect 0x800 at offset 0x31000..0x31800 => check)
HARNESS DF-5434[A2]: marker=0xa7 round start
HARNESS DF-5434[A2]: req1 -> mem=0xfffff80118380000 count=4 size=0x10000
HARNESS DF-5434[A2]: after sell1 buf3: mem=0xfffff80118380000 offset=0x30000 bytesused=0x1000 status=2 (still linked as product head)
HARNESS DF-5434[A2]: req2(count=1) -> NEW mem=0xfffff80118380000 (OLD mem=0xfffff80118380000 was kfree'd; buf3 NOT re-inited: mem=0 status=0 bytesused=0x0; product head=0 == buf3? no)
HARNESS DF-5434[A2]: victim=0xfffff80118390000 (reclaimed old mem? no)
HARNESS DF-5434[A2]: after sell2 (wrote 0x58 x 0x800 at OLDmem+3*0x10000+0x1000)
HARNESS DF-5434[A2]: no hit: found 0 bytes of 0x58 pattern inside freed/reclaimed block 0xfffff80118380000 (expect 0x800 at offset 0x31000..0x31800 => check)
HARNESS DF-5434[A3]: marker=0xc3 round start
HARNESS DF-5434[A3]: req1 -> mem=0xfffff80118380000 count=4 size=0x10000
HARNESS DF-5434[A3]: after sell1 buf3: mem=0xfffff80118380000 offset=0x30000 bytesused=0x1000 status=2 (still linked as product head)
HARNESS DF-5434[A3]: req2(count=1) -> NEW mem=0xfffff80118380000 (OLD mem=0xfffff80118380000 was kfree'd; buf3 NOT re-inited: mem=0 status=0 bytesused=0x0; product head=0 == buf3? no)
HARNESS DF-5434[A3]: victim=0xfffff80118390000 (reclaimed old mem? no)
HARNESS DF-5434[A3]: after sell2 (wrote 0x3c x 0x800 at OLDmem+3*0x10000+0x1000)
HARNESS DF-5434[A3]: no hit: found 0 bytes of 0x3c pattern inside freed/reclaimed block 0xfffff80118380000 (expect 0x800 at offset 0x31000..0x31800 => check)
HARNESS DF-5434[B]: stale-bytesused underflow round start
HARNESS DF-5434[B]: req1(len=0x2000000) mem=0xfffff80118380000
HARNESS DF-5434[B]: buf0 bytesused=0x2000000 (mid-frame, ACTIVE, product head)
HARNESS DF-5434[B]: req2(len=0x1000) NEW mem=0xfffff8011838c000 (0x2000 bytes); buf0: length=0x1000 bytesused=STALE 0x0 status=0
HARNESS DF-5434[B]: PREDICTED fault VA = 0xfffff8011a38c000 (mem2 + stale bytesused 0x2000000); maxlen = 0x1000-0x2000000 = 0xE0001000 (UNDERFLOW) => nbytes=0x1000 => OOB WRITE, triggering now
HARNESS DF-5434[B]: survived?! (write landed in mapped memory - corruption, not fault)
HARNESS DF-5434[arm]: ARMED: bq->mem=0xfffff801183a0000 bq->buf_count=0x8 bq->buf_size=0x1000