DragonFlyBSD Kernel Audit
DF-2615 / run_df2615.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2615 guest-side run: N plain (non-clustered) hammer2 mount/umount
# cycles on the STOCK kernel; watch the M_HAMMER2 ("HAMMER2-mount") malloc
# type in-use count in vmstat -m.  Expect ~ +1 allocation per cycle leaked
# (the undrained LNK_PING kdmsg_msg from kdmsg_iocom_uninit).
# The instrumented-kernel run (same script) instead counts DF2615_LEAK
# kprintf lines in dmesg.
set -x
N=${1:-20}
D=/root/poc/df2615
mkdir -p $D
vnconfig -u vn0 2>/dev/null
dd if=/dev/zero of=$D/img bs=1m count=64 2>/dev/null
vnconfig -c vn0 $D/img
newfs_hammer2 -L testvol /dev/vn0 > $D/newfs.log 2>&1
mkdir -p /mnt/h2cyc

dmesg > $D/dmesg.before

B=$(vmstat -m | awk '$1=="HAMMER2-mount"{print $2}')
echo "BEFORE_INUSE=$B"

i=0; fail=0
while [ $i -lt $N ]; do
	if ! mount -t hammer2 /dev/vn0@testvol /mnt/h2cyc; then
		fail=$((fail+1)); echo "MOUNT_FAIL_AT=$i"; break
	fi
	if ! umount /mnt/h2cyc; then
		fail=$((fail+1)); echo "UMOUNT_FAIL_AT=$i"; break
	fi
	i=$((i+1))
done

A=$(vmstat -m | awk '$1=="HAMMER2-mount"{print $2}')
echo "AFTER_INUSE=$A"
echo "CYCLES_OK=$i FAILURES=$fail"
echo "DELTA_INUSE=$((A - B)) (1-per-cycle leak => expect ~$N)"

dmesg > $D/dmesg.after
L_B=$(grep -c DF2615_LEAK $D/dmesg.before); L_A=$(grep -c DF2615_LEAK $D/dmesg.after)
echo "DF2615_LEAK_LINES_BEFORE=$L_B AFTER=$L_A DELTA=$((L_A - L_B))"
grep DF2615_LEAK $D/dmesg.after | tail -5
vnconfig -u vn0 2>/dev/null
echo RUN_DF2615_DONE