⬢ DragonFlyBSD Kernel Audit
DF-5547 / fix_validation.log
← back to finding ↓ download raw
# DF-5547 fix validation (same guest, same harness, ONLY change = fix.diff applied
# to /usr/src/sys/bus/firewire/fwmem.c, module rebuilt from the patched production file)
# commands (root):
#   cp fwmem.fixed.c /usr/src/sys/bus/firewire/fwmem.c && cd /root/df5547 && sh build.sh
#   kldload ./df5547.ko && sysctl kern.df5547_test=1 && dmesg | grep "bytes past buffer"
# verbatim output:
=== TEST 1 (fixed: expect NO OOB) ===
kern.df5547_test: 0 -> 0
df5547: bcount=29 pay_len=32 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change
df5547: bcount=1 pay_len=4 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change
df5547: bcount=2 pay_len=4 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change
df5547: bcount=3 pay_len=4 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change
df5547: bcount=5 pay_len=8 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change
df5547: bcount=2047 pay_len=2048 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change
df5547: bcount=28 pay_len=28 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change
df5547: bcount=32 pay_len=32 xfer.ok=1 biodone=1 b_error=0 b_resid=0 | bytes past buffer: aa aa aa aa -> no change
# => the identical padded-response trigger no longer writes past any buffer; the RPC
#    still completes (biodone=1, b_error=0, resid=0).  fix_status: fixed.