⬢ DragonFlyBSD Kernel Audit
DF-5563 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-5563",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cd /root/df5563 && sh build.sh (after staging + applying disclosed setup fixes DF-5559/DF-5560 to /usr/src and building iicbus.ko/iic.ko)",
    "run": "sh /root/df5563/run_f1.sh   # variant B: park via /dev/df5563, unload 5 modules, kill -9 -> panic;  run_f1a.sh = variant A via /dev/iic0",
    "expected": "Fatal trap 12: page fault while in kernel mode, fault virtual address = 0xffffffff826001ab (unloaded iicbus.ko+0x1ab), instruction pointer = same, current process = the parked requester; after fix.diff: no panic, all unloads rc=0, ioctl returns ENXIO, guest healthy"
  },
  "kernel_refs": [
    "sys/bus/iicbus/iiconf.c:56-76",
    "sys/bus/iicbus/iiconf.c:63",
    "sys/bus/iicbus/iiconf.c:67",
    "sys/bus/iicbus/iiconf.c:85-117",
    "sys/bus/iicbus/iiconf.c:92-97",
    "sys/bus/iicbus/iiconf.c:101-105",
    "sys/bus/iicbus/iicbus.c:156-162",
    "sys/bus/iicbus/iicbus/Makefile",
    "sys/kern/subr_bus.c:853-899"
  ],
  "artifacts": [
    "df5563_rig.c", "iicbb_reg.c", "park.c", "Makefile.rig", "Makefile.reg",
    "build.sh", "build.log",
    "run_f1.sh", "run_f1a.sh", "run_f1_variantB.log", "run_f1_variantA.log",
    "run_f2.sh", "run_f2_baseline.log", "run_f3.sh", "run_f3_baseline.log",
    "run_fixed_validation.log", "panic.txt", "panic_variant_a.txt",
    "env.txt", "fix.diff", "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}