DragonFlyBSD Kernel Audit
DF-0604 / run.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-0604 run script
# Runs the live cross-CPU race trigger (requires root + pf loaded)
#
# The race fires when:
#   (A) pfctl rule churn (DIOCADDRULE -> pfi_dynaddr_setup -> pfi_table_update)
#       runs on the CALLER'S CPU
#   (B) ifaddr alias/-alias churn (SIOCAIFADDR dispatched to netisr0 ->
#       ifaddr_event -> pfi_table_update) runs on NETISR0
# Both paths share the global pfi_buffer with no lock -> race.
#
# On an unpatched kernel with race-detection instrumentation, this prints
# "DF0604_RACE" messages and may panic. On a fixed kernel (dispatch-to-netisr0),
# it completes cleanly with 0 races.

DURATION=${1:-30}

# Ensure pf loaded and rules set
kldload pf 2>/dev/null || true
cat > /tmp/pf_0604.conf << 'PFEOF'
pass quick on vtnet0 inet from (vtnet0) to any
pass quick on vtnet0 inet6 from (vtnet0) to any
block in quick from (vtnet0:network) to any
PFEOF
pfctl -f /tmp/pf_0604.conf 2>&1

echo "Running race trigger for ${DURATION}s..."

# Also run the code-level proof as a complement
echo "=== Code-level race proof ==="
timeout 10 ./race_proof 2>&1 | head -10
echo ""

# Live race trigger
echo "=== Live race trigger (pfctl churn + ifaddr churn) ==="
sh ./race_live.sh "$DURATION"

# Check results
echo ""
echo "Race detections: $(dmesg | grep -c 'DF0604_RACE' 2>/dev/null)"
echo "Panics: $(dmesg | grep -c 'fatal trap\|panic' 2>/dev/null)"