DragonFlyBSD Kernel Audit
DF-2616 / panic_B.txt
← back to finding ↓ download raw
# DF-2616 variant B: panic loading crafted FILE DATA chain (stock INVARIANTS kernel)
# trigger: mount -t hammer2 /dev/vn0@testvol /mnt/h2 (OK); ls/cat /mnt/h2/f1
# crafted bref: f1 DATA data_off = 0x1c0ff0a (radix 10 VALID, lbase 0x1c0ff00, misaligned + crossing; methods=0x00 CHECK_NONE)

hammer2_mount: "/dev/vn0": no recovery needed
hammer2_mount: hmp=0xfffff80118580000 pmp=0xfffff80118d60000
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
HAMMER2: CONN WAS TERMpaniIc: asNsertioAn "pbase != 0 && ((lbase + lsize - 1)T & pEmask) == pDbase" 
f
ailed in hammer2_io_alloc at /usr/src/sys/vfs/hammer2/hammer2_io.c:126
cpuid = 3
Trace beginning at frame 0xfffff80118de5710
_hammer2_io_getblk() at _hammer2_io_getblk+0xc6 0xffffffff80964d46 
_hammer2_io_getblk() at _hammer2_io_getblk+0xc6 0xffffffff80964d46 
_hammer2_io_bread() at _hammer2_io_bread+0x17 0xffffffff80965397 
hammer2_chain_load_data() at hammer2_chain_load_data+0x2a5 0xffffffff8096f4a5 
hammer2_chain_lock() at hammer2_chain_lock+0xde 0xffffffff8096fa4e 
hammer2_chain_get() at hammer2_chain_get+0x45 0xffffffff80970685 
Debugger("panic")

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>