⬢ DragonFlyBSD Kernel Audit
DF-5776 / run.patched.out
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
open(/dev/pci, O_RDWR) = 3 (root, securelevel<0)

== 1. sanity: in-range registers work (0:3:0 virtio NIC) ==
in-range reg 0x00                  PCIOCREAD reg=0           w=4 rc=0   errno=0   data=0x10001af4

== 2. pi_reg past legacy space (256..4095: ECAM-only) ==
reg 0x100 (one past REGMAX)        PCIOCREAD reg=256         w=4 rc=0   errno=0   data=0xffffffff
reg 0xFFC (last ECAM dword)        PCIOCREAD reg=4092        w=4 rc=0   errno=0   data=0xffffffff

== 3. pi_reg past EVERY mechanism (>4095) ==
reg 0x1000 (PCIE_REGMAX+1)         PCIOCREAD reg=4096        w=4 rc=-1  errno=22  data=0x00000000
reg 0x10000                        PCIOCREAD reg=65536       w=4 rc=-1  errno=22  data=0x00000000
reg 0x7FFFFFFC (INT_MAX-3)         PCIOCREAD reg=2147483644  w=4 rc=-1  errno=22  data=0x00000000

== 4. the ONLY validations at the ioctl layer ==
reg -4 (negative)                  PCIOCREAD reg=-4          w=4 rc=-1  errno=22  data=0x00000000
reg 2 w=4 (misaligned)             PCIOCREAD reg=2           w=4 rc=-1  errno=22  data=0x00000000

== 5. PCIOCWRITE: dropped silently, reports success ==
write reg 0x100                    PCIOCWRITE reg=256         w=4 val=0xdeadbeef rc=0   errno=0
write reg 0x1000                   PCIOCWRITE reg=4096        w=4 val=0xdeadbeef rc=-1  errno=22
write reg 0x7FFFFFFC               PCIOCWRITE reg=2147483644  w=4 val=0xdeadbeef rc=-1  errno=22
readback reg 0x100                 PCIOCREAD reg=256         w=4 rc=0   errno=0   data=0xffffffff
   readback of dropped write: 0xffffffff (0 = never landed)

== 6. guest health: device config intact ==
reg 0x00 after writes              PCIOCREAD reg=0           w=4 rc=0   errno=0   data=0x10001af4
   vendor/dev unchanged: YES

== 7. ENODEV control (bad function) ==
0:3:7 (no such func)               rc=-1 errno=19 (expect rc=-1 ENODEV)

== 8. PCIOCGETCONF counter/pagination sanity (negative probe) ==
match_buf_len=0xFFFFFFFF           rc=0 num_matches=7 offset=7 gen=7 status=0
page size 2 (1st)                  rc=0 num_matches=2 offset=2 status=2
page size 2 (2nd)                  rc=0 num_matches=2 offset=4 status=2
pat_buf_len=n*sizeof+1             rc=-1 errno=22 status=0 (expect EINVAL)
offset=0xFFFFFF                    rc=0 status=1 (expect LAST_DEVICE=0)

== 9. PCIOCGETBAR pbi_reg unvalidated (negative probe) ==
GETBAR 0:2:0 reg 0x10              rc=0 errno=0 base=0xfd000008 len=16777216
GETBAR reg 1 (misaligned)          rc=-1 errno=22 (rle lookup contains it)
GETBAR reg -1 (negative)           rc=-1 errno=22

PROBE COMPLETE - guest still alive