DF-5095
MFI_DEBUG timeout helpers print kernel heap pointer (cm) and the pmap_kextract() physical address of command data buffers to the world-readable kernel message buffer
Summary
In MFI_DEBUG builds the timeout path prints cm=%p and pmap_kextract(cm->cm_data) into msgbuf (world-readable via dmesg; no %p hashing on DF). Double-gated (option off by default + LSI hardware). Note: mfi.c:3476/3519 print the same cm %p unconditionally even in non-debug builds. Print-index-not-pointer fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5095 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 928 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5095
Confirmed kernel references
Detail
Evidence (decisive lines)
source trace in finding markdown
Verified recommended fix
print cm_index instead of cm pointer; drop pmap_kextract
Verdict
untested (double-gated: MFI_DEBUG off + no MegaRAID on guest)
No comments yet.