⬢ DragonFlyBSD Kernel Audit
DF-5558 / run2-full.log
← back to finding ↓ download raw 
+ cd /root/df5558
+ sh build.sh
+ ls -l /usr/src/sys/bus/iicbus/iicbus/iicbus.ko /usr/src/sys/bus/iicbus/iic/iic.ko
-rw-r--r--  1 root  1000  10584 Oct  7 16:12 /usr/src/sys/bus/iicbus/iic/iic.ko
-rw-r--r--  1 root  1000  11976 Oct  7 16:12 /usr/src/sys/bus/iicbus/iicbus/iicbus.ko
+ kldload /usr/src/sys/bus/iicbus/iicbus/iicbus.ko
+ kldload /boot/kernel/iicbb.ko
+ kldload /usr/obj/root/df5558/build_reg/iicbb_reg.ko
+ kldload /usr/obj/root/df5558/build_h/iicbb_harness.ko
+ kldload /usr/src/sys/bus/iicbus/iic/iic.ko
+ sleep 1
+ ls -l /dev/iic0
crw-------  1 root  wheel   32, 0x00000000 Oct  7 16:12 /dev/iic0
+ kldload /usr/obj/root/df5558/build_g/groom5558.ko
+ sysctl 'df5558.readivar=1'
df5558.readivar: 0 -> 0
+ echo '=============== RUN 1'
=============== RUN 1
+ ./rdwrleak /dev/iic0
opened /dev/iic0
sanity: RD from ACKing slave 0x50 size=16 rc=0 pattern_ok=YES first=c0 c1 c2 c3
variant=A size=256   groom=1 rc=0 errno=0 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
    0000: ff ff ff ff ff ff ff ff 41 4c 45 48 45 41 50 21
    0010: 02 00 00 00 00 00 00 00 00 01 00 00 5a 5a 5a 5a
    0020: 02 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0030: 02 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0040: 02 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0050: 02 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
variant=A size=256   groom=1 rc=0 errno=2 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
variant=A size=256   groom=1 rc=0 errno=2 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=no  kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=no  kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=no  kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=no  kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=no  kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=no  kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=no  kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=no  kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=no  kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
groomed attempts done: leak_observed=12
ungroomed hunt: leak_iters=0/200 total_nonprefill=0 total_markers=0 total_kptr_qwords=0
RESULT: UNINITIALIZED KERNEL HEAP DISCLOSED TO USERSPACE
+ echo '=============== RUN 2'
=============== RUN 2
+ ./rdwrleak /dev/iic0
opened /dev/iic0
sanity: RD from ACKing slave 0x50 size=16 rc=0 pattern_ok=YES first=c0 c1 c2 c3
variant=A size=256   groom=1 rc=0 errno=0 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
    0000: ff ff ff ff ff ff ff ff 41 4c 45 48 45 41 50 21
    0010: 1a 00 00 00 00 00 00 00 00 01 00 00 5a 5a 5a 5a
    0020: 1a 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0030: 1a 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0040: 1a 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0050: 1a 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
variant=A size=256   groom=1 rc=0 errno=2 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
variant=A size=256   groom=1 rc=0 errno=2 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=no  kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=no  kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=no  kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=no  kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=no  kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=no  kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=no  kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=no  kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=no  kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
groomed attempts done: leak_observed=12
ungroomed hunt: leak_iters=0/200 total_nonprefill=0 total_markers=0 total_kptr_qwords=0
RESULT: UNINITIALIZED KERNEL HEAP DISCLOSED TO USERSPACE
+ echo '=============== RUN 3'
=============== RUN 3
+ ./rdwrleak /dev/iic0
opened /dev/iic0
sanity: RD from ACKing slave 0x50 size=16 rc=0 pattern_ok=YES first=c0 c1 c2 c3
variant=A size=256   groom=1 rc=0 errno=0 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
    0000: ff ff ff ff ff ff ff ff 41 4c 45 48 45 41 50 21
    0010: 32 00 00 00 00 00 00 00 00 01 00 00 5a 5a 5a 5a
    0020: 32 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0030: 32 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0040: 32 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
    0050: 32 00 00 00 58 ff ff ff 5a 5a 5a 5a 5a 5a 5a 5a
variant=A size=256   groom=1 rc=0 errno=2 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
variant=A size=256   groom=1 rc=0 errno=2 non-prefill=255   marker=no  kptr-qwords=0
variant=B size=256   groom=1 rc=-1 errno=2 non-prefill=256   marker=no  kptr-qwords=15   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=no  kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=no  kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=512   groom=1 rc=0 errno=2 non-prefill=510   marker=no  kptr-qwords=0
variant=B size=512   groom=1 rc=-1 errno=2 non-prefill=512   marker=no  kptr-qwords=31   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=no  kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=no  kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=1024  groom=1 rc=0 errno=2 non-prefill=1020  marker=no  kptr-qwords=0
variant=B size=1024  groom=1 rc=-1 errno=2 non-prefill=1024  marker=no  kptr-qwords=63   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=no  kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=no  kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
variant=A size=2048  groom=1 rc=0 errno=2 non-prefill=2040  marker=no  kptr-qwords=0
variant=B size=2048  groom=1 rc=-1 errno=2 non-prefill=2048  marker=no  kptr-qwords=127   <== LEAK (error returned yet buffer overwritten)
groomed attempts done: leak_observed=12
ungroomed hunt: leak_iters=0/200 total_nonprefill=0 total_markers=0 total_kptr_qwords=0
RESULT: UNINITIALIZED KERNEL HEAP DISCLOSED TO USERSPACE
+ echo '=============== dmesg tail'
=============== dmesg tail
+ tail -25
+ dmesg
hammer2_mount: hmp=0xfffff8008fae0000 pmp=0xfffff80090280000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
fakebb0: <fake GPIO bit-bang i2c master+slave> on motherboard
iicbb0: <I2C bit-banging driver> on fakebb0
iicbus0: <Philips I2C bus> on iicbb0 addr 0xff
[fakebb] attach done: resets=3 resets_with_oldaddr=1 bus=0xfffff8008bb64dc0
[fakebb] request_bus error=0
[fakebb] write: error=0 sent=8 slave_rx=deadbeef55aa1234 ok=1
[fakebb] read: error=0 read=8 data=c0c1c2c3c4c5c6c7 ok=1
[fakebb] nacked-write: error=2 (IIC_ENOACK=2) bus_started_after=0
[fakebb] repstart-read: error=0 byte=0xc0 (expect 0xc0)
[fakebb] SUMMARY: write_ok=1 read_ok=1 starts=5 stops=4 rxlen=0 spray_sink=0
rdrand0: No RdRand support.
iic0: <I2C generic I/O> on iicbus0
[df5558] groom5558 loaded (sink=0)
[df5558]   iicbus0 child 0: name=ic unit=0
[df5558]   iicbus0 child 1: name=iic unit=0
[df5558]   iicbus0 child 2: name=iicsmb unit=0
[df5558] readivar: BUS_READ_IVAR error=0 (ENXIO=6) v=0x0 (written)