\begin{table*}[t!]
\centering
\footnotesize
\begin{tabular}{p{1.5in}|p{0.5in}|p{4in}}
{\bf Bug Type and How Found} & {\bf Driver} & {\bf Bug Description} \\

\hline

% Fixed yes
% Count as one bug
Hardware Dep. \& Specific path, Kernel crash & 8139too & Driver
dereferences invalid pointer along an unlikely execution path. \\

% Unknown
% Count as one bug
Hardware Dep. \& Interprocedural, kernel crash & be2net & A hardware
dependence bug in the be2net \codesm{be\_tx\_compl\_get} function that
leads to a call to the \codesm{be\_tx\_compl\_process}
\codesm{BUG\_ON} macro. \\

% Fixed no/no
% Count as two bugs
Hardware Dep. \& Interprocedural, pointer aliasing, kernel crash &
dl2k, et131x & Drivers pass pointers stored in DMA memory to
\codesm{rio\_close} and \codesm{et131x\_free\_send\_packet}, which
could be corrupted by the device. \\

% Fixed no
% Count as one bug
Hardware Dep. \& Interprocedural, checker & ks8851 & Driver may invoke
\codesm{netdev\_alloc\_skb\_ip\_align} with a large size if the
hardware malfunctions. \\

\hline

% Fixed yes
% Count as one bug
API Misuse \& Specific path, kernel crash & 8139too & Incorrect usage
of the \codesm{schedule\_delayed\_work} and
\codesm{flush\_delayed\_work} kernel functions during shutdown with
specific chip. \\

% Fixed no
% Count as one bug
API Misuse \& Interprocedural, checker & a1026 & Kmalloc may be called
with a size of 0.  While acceptable, this code is brittle. \\

% Fixed no
% Count as one bug
API Misuse \& Interprocedural, kernel crash & akm8975 & Never
flushes/cancels work queue during shutdown. \\

% Fixed no
% Count as one bug
API Misuse \& Specific path, interprocedural, checker & akm8975 &
Incorrectly calls \codesm{free\_irq} even with no corresponding call
to \codesm{request\_irq} along some paths. \\

% Fixed yes
% Count as two bugs
API Misuse \& Checker & be2net & Inappropriate calls to
\codesm{netif\_stop\_queue} and \codesm{netif\_carrier\_off} before
calling \codesm{register\_netdev}. \\

% Unknown
% Count as one bug
API Misuse \& Specific path, interprocedural, checker & be2net &
Incorrectly leaves the transmit queue enabled after returning an error
code from \codesm{be\_open}. \\

% Fixed yes
% Count as two bugs
% 10 so far including these
API Misuse \& Checker & e1000 & Incorrect calls to
\codesm{netif\_carrier\_off} and \codesm{netif\_stop\_queue} functions
before calling \codesm{register\_netdev}. \\

% Fixed no
% Count as one bug
API Misuse \& Checker & et131x & Incorrect call to
\codesm{netif\_carrier\_off} before \codesm{register\_netdev} in
et131x. \\

% Fixed no
% Count as one bug
API Misuse \& Kernel crash & ks8851 & Does not flush work queues
appropriately on module unload. \\

% Driver removed from kernel eventually - fixed on their website
% Count as one bug
API Misuse \& Kernel crash & lp5523 & Driver does not null-terminate an
array passed to \codesm{sysfs\_create\_group}, which leads to
unexpected behavior in an infrequently-invoked entry point. \\

% Driver removed from kernel eventually - fixed on their website
% Count as one bug
API Misuse \& Kernel crash & me4000 & Incorrect call to
\codesm{spin\_lock} in \codesm{me4000\_open} stemming from a
copy/paste error. \\

% Fixed no
% Count as two bugs
API Misuse \& Interprocedural, kernel warning & pcnet32 & Incorrect
calls to \codesm{pci\_free\_consistent} in
\codesm{pcnet32\_realloc\_tx\_ring} and
\codesm{pcnet32\_realloc\_rx\_ring} while holding a spinlock. \\

\hline

% Unknown - I don't understand it.  All results currently exclude this
%Race & e1000 & \fixme{Race condition in e1000\_clean\_tx\_irq -- need
%to verify or remove -- reproduced again Oct 11} \\

% Fixed no
% Count as two bugs
Race \& Reentrant interrupt, kernel crash & pluto2, akm8975 & Incorrect
call to \codesm{request\_irq} before the driver is ready to service
all interrupts. \\

% Fixed no
% Count as one bug
Race \& Reentrant interrupt, kernel crash & ks8851 & Spurious interrupt
could crash kernel because of missing synchronization. \\

\hline

% Fixed no
% Count as three bugs
Allocator \& Interprocedural, checker & akm8975, mmc31xx, tle62x0 &
Driver calls \codesm{device\_create\_file} but never subsequently
removes the file. \\

% Fixed yes Count as one bug
Allocator \& Pointer aliasing, interprocedural, checker & be2net &
Incorrect calls to \codesm{pci\_unmap\_page} in
\codesm{be\_rx\_q\_clean}. \\

% Fixed yes
% Count as one bug
Allocator \& Pointer aliasing, interprocedural, checker & e1000 &
Allocator/deallocator mismatch, in which the driver incorrectly pairs
\codesm{pci\_map\_single} with \codesm{pci\_unmap\_page}. \\

% Fixed yes
% Count as one bug
Allocator \& Pointer aliasing, interprocedural, checker & forcedeth &
Allocator/deallocator mismatch: \codesm{nv\_release\_txskb}
incorrectly uses \codesm{pci\_unmap\_page} instead of
\codesm{pci\_unmap\_single}. \\

\hline

% Fixed no
% Count as one bug
Resource leak \& Interprocedural checker & pluto2 & Never calls
\codesm{dvb\_frontend\_detach} during module unload. \\

% Fixed no
% Count as one bug
Resource leak \& Interprocedural, checker & mmc31xx & Driver calls
\codesm{class\_create} but never subsequently removes the class. \\

% Fixed no
% Count as one bug
Resource leak \& Interprocedural, checker & mmc31xx & Driver calls
\codesm{device\_create} but never subsequently removes the device. \\

\hline

% Unknown
% Count as two bugs
Interface \& Checker & be2net & Returns non-standard codes on an error
condition from \codesm{be\_open} and \codesm{be\_probe}. \\

% Fixed yes
% Count as one bug
Interface \& Checker & econet & Missing permissions check in driver's
ioctl, described in CVE-2010-3850. \\

% Fixed yes
% Count as one bug
Pointer \& Interprocedural, kernel crash & econet & Null pointer
dereference in the \codesm{send\_msg} call, described in
CVE-2010-3849. \\

\end{tabular}
\caption{\small \bf Bugs found by \Arch.  Hardware dependence bugs
  arise when unexpected device inputs trigger the bug. Of these bugs,
  at least six remain unfixed, and we were unable to establish the
  current status of three others because of significant driver
  changes.}
\label{fig:table-bugs}
\vspace{-0.1in}
\end{table*}
