⬢ DragonFlyBSD Kernel Audit
DF-2623 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-2623",
  "verdict": "reproduced",
  "impact": "none",
  "reproduce": {
    "build": "guest: newfs_hammer2 -L testvol + one file (build.sh); host: python3 forge_2623.py base2623.img craft2623.img (clears PFSROOT on the PFS inode bref)",
    "run": "guest root: vnconfig -c vn0 craft2623.img; mount -t hammer2 /dev/vn0@testvol /mnt/h2x  (RW)",
    "expected": "console: 'hammer2: Correct mis-flagged PFS testvol' - printed from ripdata captured BEFORE hammer2_chain_modify released the old dio (use-after-release read); instrumented kernel shows ripdata != chain->data at print time; second mount prints nothing (flag repaired+flushed)"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_vfsops.c:2366-2418",
    "sys/vfs/hammer2/hammer2_vfsops.c:2399",
    "sys/vfs/hammer2/hammer2_vfsops.c:2401-2406",
    "sys/vfs/hammer2/hammer2_vfsops.c:1336-1338",
    "sys/vfs/hammer2/hammer2_chain.c:1797",
    "sys/vfs/hammer2/hammer2_chain.c:1827",
    "sys/vfs/hammer2/hammer2_chain.c:1858-1859"
  ],
  "artifacts": [
    "forge_2623.py", "h2common.py", "run_2623.sh", "run_stock.log",
    "run_instr.log", "console_excerpts.txt", "fix.diff",
    "instr_build.log", "instr_build2.log", "instr_install.log",
    "fix_build.log", "fix_install.log", "env.txt",
    "README.md", "VERDICT.md", "build.sh", "run.sh", "manifest.json", "verdict.json"
  ]
}