DragonFlyBSD Kernel Audit
DF-2621 / trigger2.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2621 trigger v2: same as v1 but umount -f, shorter windows, richer census.
D=/root/poc/df2621
LOG=$D/run2.log
exec > $LOG 2>&1
set -x

vnconfig -u vn0 2>/dev/null
vnconfig -u vn1 2>/dev/null

rm -f $D/base.img $D/clone.img
truncate -s 64M $D/base.img
newfs_hammer2 -L testvol $D/base.img
dd if=$D/base.img of=$D/clone.img bs=1m 2>/dev/null

vnconfig -c vn0 $D/base.img
vnconfig -c vn1 $D/clone.img
mkdir -p /mnt/h2 /mnt/h2b

census() {
	echo -n "  threads="
	ps axlw | grep "h2xop-testvol" | grep -v grep | wc -l
	echo -n "  idle="
	ps axlw | grep "h2xop-testvol" | grep -v grep | grep -c h2idle || true
	echo -n "  frozen(h2twait)="
	ps axlw | grep "h2xop-testvol" | grep -v grep | grep -c h2twait || true
}

echo "=== 0. baseline ==="
echo -n "T0="; census

echo "=== 1. mount vn0@testvol ==="
mount -t hammer2 -o ro /dev/vn0@testvol /mnt/h2
echo MOUNT1_RC=$?
echo -n "T1="; census

echo "=== 2. mount vn1@testvol (same clid): merge then EBUSY ==="
mount -t hammer2 -o ro /dev/vn1@testvol /mnt/h2b
echo "MOUNT2_RC=$? (expect 1)"
echo -n "T2="; census

echo "=== 3. umount -f /mnt/h2 ==="
date
umount -f /mnt/h2
echo UMOUNT_RC=$?
date
echo -n "T3="; census
mount

echo "=== 4. poll window (10s x 9) ==="
i=0
while [ $i -lt 9 ]; do
	echo -n "w$i"; census
	i=$((i+1))
	sleep 10
done

echo "=== 5. unbind vn devices (force dev close if still held) ==="
vnconfig -u vn0; echo VNU0=$?
vnconfig -u vn1; echo VNU1=$?
echo -n "T5="; census

echo "=== 6. post-unbind window (10s x 9): pmp freed? orphans poll freed pmp ==="
i=0
while [ $i -lt 9 ]; do
	echo -n "p$i"; census
	i=$((i+1))
	sleep 10
done
echo TRIGGER_V2_DONE