⬢ DragonFlyBSD Kernel Audit
DF-0855 / run.stress.log
← back to finding ↓ download raw 
=== DF-0855 dirfs_findfd KKASSERT panic / NULL deref ===

setup: root=0x8004904c0 (fd=3, isroot), file=0x8004904a0 (fd=DIRFS_NOFD, parent=root)
       file->dn_parent = 0x8004904c0 (valid)

[happy path, parent intact]
  BUGGY: pathnp=0x8004904c0 panic=0 path="file.txt"   (expect panic=0, path set)
  FIXED: pathnp=0x8004904c0 panic=0 path="file.txt"   (expect panic=0, path set)

[AFTER dirfs_nremove: file->dn_parent = NULL (unlinked, vnode alive)]
       file->dn_parent = 0x0

[fstat(fd) -> VOP_GETATTR -> dirfs_getattr -> dirfs_findfd]
  BUGGY: pathnp=0x0 panic=1
         ** PANIC: assertion "dnp1 != NULL" failed in dirfs_findfd at dirfs_subr.c:480
         ** => kernel panic (KKASSERT w/ INVARIANTS) or NULL deref (without)
  FIXED: pathnp=0x0 tmp=NULL pf=0x0  (expect NULL — caller returns ESTALE)
         => no panic, no leak; caller (dirfs_getattr) returns ESTALE

=== SUMMARY ===
DF_0855_BUG_PANIC_ON_UNLINKED_NODE   = YES (KKASSERT fires)
DF_0855_FIX_RETURNS_NULL_NO_PANIC    = YES
RUN_EXIT=0
---RUN2---
=== DF-0855 dirfs_findfd KKASSERT panic / NULL deref ===

setup: root=0x8004904c0 (fd=3, isroot), file=0x8004904a0 (fd=DIRFS_NOFD, parent=root)
       file->dn_parent = 0x8004904c0 (valid)

[happy path, parent intact]
  BUGGY: pathnp=0x8004904c0 panic=0 path="file.txt"   (expect panic=0, path set)
  FIXED: pathnp=0x8004904c0 panic=0 path="file.txt"   (expect panic=0, path set)

[AFTER dirfs_nremove: file->dn_parent = NULL (unlinked, vnode alive)]
       file->dn_parent = 0x0

[fstat(fd) -> VOP_GETATTR -> dirfs_getattr -> dirfs_findfd]
  BUGGY: pathnp=0x0 panic=1
         ** PANIC: assertion "dnp1 != NULL" failed in dirfs_findfd at dirfs_subr.c:480
         ** => kernel panic (KKASSERT w/ INVARIANTS) or NULL deref (without)
  FIXED: pathnp=0x0 tmp=NULL pf=0x0  (expect NULL — caller returns ESTALE)
         => no panic, no leak; caller (dirfs_getattr) returns ESTALE

=== SUMMARY ===
DF_0855_BUG_PANIC_ON_UNLINKED_NODE   = YES (KKASSERT fires)
DF_0855_FIX_RETURNS_NULL_NO_PANIC    = YES
RUN_EXIT=0
---RUN3---
=== DF-0855 dirfs_findfd KKASSERT panic / NULL deref ===

setup: root=0x8004904c0 (fd=3, isroot), file=0x8004904a0 (fd=DIRFS_NOFD, parent=root)
       file->dn_parent = 0x8004904c0 (valid)

[happy path, parent intact]
  BUGGY: pathnp=0x8004904c0 panic=0 path="file.txt"   (expect panic=0, path set)
  FIXED: pathnp=0x8004904c0 panic=0 path="file.txt"   (expect panic=0, path set)

[AFTER dirfs_nremove: file->dn_parent = NULL (unlinked, vnode alive)]
       file->dn_parent = 0x0

[fstat(fd) -> VOP_GETATTR -> dirfs_getattr -> dirfs_findfd]
  BUGGY: pathnp=0x0 panic=1
         ** PANIC: assertion "dnp1 != NULL" failed in dirfs_findfd at dirfs_subr.c:480
         ** => kernel panic (KKASSERT w/ INVARIANTS) or NULL deref (without)
  FIXED: pathnp=0x0 tmp=NULL pf=0x0  (expect NULL — caller returns ESTALE)
         => no panic, no leak; caller (dirfs_getattr) returns ESTALE

=== SUMMARY ===
DF_0855_BUG_PANIC_ON_UNLINKED_NODE   = YES (KKASSERT fires)
DF_0855_FIX_RETURNS_NULL_NO_PANIC    = YES
RUN_EXIT=0