DF-0604 / run.sh
#!/bin/sh # DF-0604 run script # Runs the live cross-CPU race trigger (requires root + pf loaded) # # The race fires when: # (A) pfctl rule churn (DIOCADDRULE -> pfi_dynaddr_setup -> pfi_table_update) # runs on the CALLER'S CPU # (B) ifaddr alias/-alias churn (SIOCAIFADDR dispatched to netisr0 -> # ifaddr_event -> pfi_table_update) runs on NETISR0 # Both paths share the global pfi_buffer with no lock -> race. # # On an unpatched kernel with race-detection instrumentation, this prints # "DF0604_RACE" messages and may panic. On a fixed kernel (dispatch-to-netisr0), # it completes cleanly with 0 races. DURATION=${1:-30} # Ensure pf loaded and rules set kldload pf 2>/dev/null || true cat > /tmp/pf_0604.conf << 'PFEOF' pass quick on vtnet0 inet from (vtnet0) to any pass quick on vtnet0 inet6 from (vtnet0) to any block in quick from (vtnet0:network) to any PFEOF pfctl -f /tmp/pf_0604.conf 2>&1 echo "Running race trigger for ${DURATION}s..." # Also run the code-level proof as a complement echo "=== Code-level race proof ===" timeout 10 ./race_proof 2>&1 | head -10 echo "" # Live race trigger echo "=== Live race trigger (pfctl churn + ifaddr churn) ===" sh ./race_live.sh "$DURATION" # Check results echo "" echo "Race detections: $(dmesg | grep -c 'DF0604_RACE' 2>/dev/null)" echo "Panics: $(dmesg | grep -c 'fatal trap\|panic' 2>/dev/null)" |