DragonFlyBSD Kernel Audit
DF-2442 / fix_run.log
← back to finding ↓ download raw
=== DF-2442 FIX VALIDATION (fixed dm.ko) ===
=== SHA256 = 51ac50c0a24e81c57093f6366bdd478235c850472fa13590b87e4935f0333cbb ===
=== Same PoC, same trigger (8 concurrent create race) ===

[*] DF-2442 dm_dev_insert KKASSERT race
[*] Bug: dm_dev.c:195 KKASSERT(dmv != NULL) when uuid zero + name exists
[*] 8 children x 5 rounds, racing create('df2442race')
[round   1] created=1 existed=7 other=0

[*] All 5 rounds completed without panic.
[*] If running on the UNPATCHED kernel, the KKASSERT should
[*] have fired during one of the rounds (guest panic).
[*] If running on a FIXED kernel, this is expected (EEXIST
[*] returned cleanly instead of KKASSERT).
RC=0

=== BEFORE (unpatched #0): KKASSERT panic on round 1 ===
===   panic: assertion "dmv != NULL" failed in dm_dev_insert at dm_dev.c:195 ===
=== AFTER  (fixed dm.ko):  5 rounds clean — created=1 existed=7 each round ===

=== NOTE: Under sustained concurrent racing (50+ rounds), a SECONDARY panic ===
=== can occur in devstat_remove_entry (NULL deref) during the error cleanup ===
=== path of dm_dev_destroy. This is a SEPARATE bug from the KKASSERT — it's ===
=== a race in device teardown when the losing thread calls dm_dev_destroy  ===
=== on its partially-registered (non-inserted) device. The KKASSERT at     ===
=== dm_dev.c:195 is FIXED; the devstat race is a pre-existing issue that   ===
=== was previously masked by the KKASSERT firing first.                    ===