⬢ DragonFlyBSD Kernel Audit
DF-5545 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{
  "finding_id": "DF-5545",
  "verdict": "reproduced / panic / certain",
  "impact": "panic",
  "reproduce": {
    "build": "guest: cd /root/df5545 && make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC (boot QEMU with -device qemu-xhci or -device nec-usb-xhci,msi=on,msix=off)",
    "run": "guest: kldload /root/df5545/veto.ko; sysctl hw.df5545=1; sysctl hw.df5545=2",
    "expected": "1) veto0: DETACH VETO: returning EBUSY  2) xhci0: detached / device_detach returned 0 (swallowed)  3) xhci0 STILL has 1 child device(s): veto0(attached=1)  4) Fatal trap 12, fault va=0x20, Stopped at df5545_thread+0x91 movq 0x20(%rax),%rdx — guest dead in DDB. On the fixed kernel: returned 16, 'refusing controller teardown', no panic."
  },
  "kernel_refs": [
    "sys/bus/u4b/controller/xhci_pci.c:355",
    "sys/bus/u4b/controller/xhci_pci.c:378",
    "sys/bus/u4b/controller/xhci_pci.c:380",
    "sys/kern/subr_bus.c:1292",
    "sys/kern/subr_bus.c:2156"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "veto.c", "Makefile", "build.sh", "run.sh",
    "build.log", "run.log", "run.fix.log", "panic.txt",
    "serial_console_full.log", "fix_build.log", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}