⬢ DragonFlyBSD Kernel Audit
DF-5617 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-5617",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "findings/poc/DF-5617/build_kld.sh (df56.ko + df5617.ko in guest); ssdt via gen_ssdt.py + guest iasl",
    "run": "findings/poc/DF-5617/run.sh",
    "expected": "baseline: 'DF5617: serializer is HELD' then panic: assertion !IS_SERIALIZED failed in lwkt_serialize_enter, backtrace ig4iic_detach <- df5617_attach <- device_doattach, guest down in DDB; patched ig4.ko: 'serializer is released ... ig4iic_acpi_detach replay = 0 -- returned cleanly, NO PANIC', guest up"
  },
  "kernel_refs": [
    "sys/bus/smbus/ichiic/ig4_acpi.c:127",
    "sys/bus/smbus/ichiic/ig4_acpi.c:132",
    "sys/bus/smbus/ichiic/ig4_acpi.c:134",
    "sys/bus/smbus/ichiic/ig4_acpi.c:146",
    "sys/bus/smbus/ichiic/ig4_acpi.c:147",
    "sys/bus/smbus/ichiic/ig4_iic.c:648",
    "sys/bus/smbus/ichiic/ig4_iic.c:655",
    "sys/bus/smbus/ichiic/ig4_iic.c:678",
    "sys/kern/lwkt_serialize.c:107",
    "sys/sys/serialize.h:41"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "run.sh", "build.sh", "build_kld.sh",
    "df5617.c", "df56.c", "gen_ssdt.py", "latch_dance.py",
    "ssdt_ig4.asl", "ssdt_ig4.aml", "ssdt_ig4p.aml", "regs.bin", "window.json",
    "run.log", "run-fixed.log", "panic.txt", "baseline-boot-clean.log",
    "dance.log", "dance_kld*.log", "fix.diff", "fix_build.log", "env.txt",
    "verdict.json", "manifest.json"
  ]
}