⬢ DragonFlyBSD Kernel Audit
DF-2620 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
{
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "finding_id": "DF-2620",
  "reproduce": {
    "build": "guest: truncate -s 64M base.img && newfs_hammer2 -L testvol base.img; host: python3 findings/poc/DF-2620/forge_df2620.py base.img A A.img (and variant C)",
    "run": "guest root: sh trigger_A.sh (mount forged pfs_nmasters=0xFF image, then shutdown -r now)  /  sh trigger_C.sh (2-device same-clid MASTER+SLAVE merge, then umount -f)",
    "expected": "stock INVARIANTS kernel: variant A -> 'Fatal trap 12 ... Stopped at hammer2_xop_helper_cleanup+0x5a: cmpq $0,0x20(%rax,%r15,1)' during vfs_unmountall; variant C -> 'Fatal trap 12 ... Stopped at hammer2_primary_xops_thread+0x2d9: lock xaddl %edx,0x81558(%rsi)' during umount -f"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_vfsops.c:527",
    "sys/vfs/hammer2/hammer2_vfsops.c:528",
    "sys/vfs/hammer2/hammer2_vfsops.c:541",
    "sys/vfs/hammer2/hammer2_vfsops.c:655",
    "sys/vfs/hammer2/hammer2_vfsops.c:683",
    "sys/vfs/hammer2/hammer2_admin.c:451",
    "sys/vfs/hammer2/hammer2_admin.c:461",
    "sys/vfs/hammer2/hammer2_admin.c:463",
    "sys/vfs/hammer2/hammer2_admin.c:254",
    "sys/vfs/hammer2/hammer2.h:1063",
    "sys/vfs/hammer2/hammer2.h:1065",
    "sys/vfs/hammer2/hammer2_disk.h:972"
  ],
  "artifacts": [
    "forge_df2620.py",
    "df2620_dump.py",
    "trigger_A.sh",
    "trigger_B.sh",
    "trigger_C.sh",
    "fixA.sh",
    "fixC.sh",
    "fix.diff",
    "panic.txt",
    "panic_C.txt",
    "boot_after_A.log",
    "boot_after_C.log",
    "C_run.log",
    "fixA_run.log",
    "fixC_run.log",
    "fix_build.log",
    "env.txt",
    "code_hashes.txt",
    "VERDICT.md",
    "manifest.json",
    "verdict.json"
  ]
}