⬢ DragonFlyBSD Kernel Audit
DF-5562 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-5562",
  "verdict": "reproduced / panic / certain",
  "impact": "panic",
  "reproduce": {
    "build": "guest: cd /root/df5562 && make KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC (boot QEMU with -device pci-ohci)",
    "run": "guest: kldload /root/df5562/veto.ko; sysctl hw.df5562=1; sysctl hw.df5562=2",
    "expected": "1) veto0: DETACH VETO: returning EBUSY  2) ohci0: detached / device_detach returned 0 (swallowed)  3) ohci0 STILL has 1 child device(s): veto0(attached=1)  4) Fatal trap 12, fault va=0x58, Stopped at df5562_thread+0x91 movq 0x58(%rax),%rcx — guest dead in DDB. On the fixed kernel: returned 16, 'refusing controller teardown', DMA intact, no panic; cooperative retry detaches cleanly."
  },
  "kernel_refs": [
    "sys/bus/u4b/controller/ohci_pci.c:329",
    "sys/bus/u4b/controller/ohci_pci.c:331",
    "sys/bus/u4b/controller/ohci_pci.c:337",
    "sys/bus/u4b/controller/ohci_pci.c:348",
    "sys/bus/u4b/controller/ohci_pci.c:352",
    "sys/bus/u4b/controller/ohci_pci.c:357",
    "sys/bus/u4b/controller/ohci_pci.c:359",
    "sys/kern/subr_bus.c:1284",
    "sys/kern/subr_bus.c:2129",
    "sys/kern/subr_bus.c:2150",
    "sys/kern/subr_bus.c:1943",
    "sys/kern/subr_bus.c:889",
    "sys/bus/u4b/controller/usb_controller.c:189"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "veto.c", "Makefile", "build.sh", "run.sh",
    "build.log", "run.log", "run.fix.log", "panic.txt",
    "fix_build.log", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}