⬢ DragonFlyBSD Kernel Audit
DF-5579 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-5579",
  "title": "vkernel64 kvm_access_check() /dev/kmem validator faults on ungrown KVA: pmap_kextract()'s vtopde() assert() SIGABRTs the whole vkernel from inside the residency check (DF-5358 pc64 twin)",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "guest# cc -static -O2 -o /root/vkmem vkmem.c && sh build_image.sh && (cd /usr/src && make -j6 nativekernel KERNCONF=VKERNEL64  # needs DF-5474 SYSTEM_LD defsym workaround)",
    "run": "guest# sysctl vm.vkernel_enable=1; mkdir -p /var/vkernel; sh run.sh   # boots kernel.debug -m 512m -r /vkroot.img -n 1, runs control then trigger",
    "expected": "baseline: control pread at 512GB+1MB -> EFAULT + SURVIVED; trigger pread at 512GB+400GB -> 'Assertion failed: (x != NULL), function vtopde, file .../pmap.c, line 357' -> vkernel DEAD. fixed kernel: trigger -> EFAULT + SURVIVED, VKDONE reached, ALIVE; text control (image shortcut 0x454780) returns the same 8 kernel-text bytes in both."
  },
  "kernel_refs": [
    "sys/platform/vkernel64/x86_64/vm_machdep.c:310",
    "sys/platform/vkernel64/x86_64/vm_machdep.c:322",
    "sys/platform/vkernel64/platform/pmap.c:732",
    "sys/platform/vkernel64/platform/pmap.c:357",
    "sys/platform/vkernel64/platform/pmap.c:273",
    "sys/platform/vkernel64/platform/pmap.c:1563",
    "sys/platform/vkernel64/include/vmparam.h:80",
    "sys/platform/vkernel64/platform/init.c:609",
    "sys/kern/kern_memio.c:285",
    "sys/platform/vkernel64/x86_64/exception.c:226"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "vkmem.c", "build.sh", "build_image.sh",
    "run.sh", "run_ctl.sh", "run_fixed.sh", "vkbuild.log", "vkfixbuild.log",
    "run.log", "run.baseline.log", "run.ctl.log", "run.fixed.log",
    "panic.txt", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}