DragonFlyBSD Kernel Audit
DF-2657 / trigger_df2657.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2657 baseline (stock kernel): 2-master same-clid cluster formed from
# dd clones; sync threads (h2nod) must park in h2coll FOREVER (quorum
# unreachable: own column excluded from the xop but counted as umasters);
# umount -f then wedges in h2twait forever.
# All evidence to /root/poc/df2657/.
D=/root/poc/df2657
mkdir -p $D
exec > $D/run.log 2>&1
set -x
for v in vn0 vn1 vn2; do vnconfig -u $v 2>/dev/null; done
for m in /mnt/h2 /mnt/h2b /mnt/h2d; do timeout 10 umount -f $m 2>/dev/null; done

echo '=== 0. build base image (fresh newfs, one MASTER PFS "testvol") ==='
dd if=/dev/zero of=/root/poc/base.img bs=1m count=256 status=none
vnconfig -c vn0 /root/poc/base.img
newfs_hammer2 -L testvol /dev/vn0
echo "NEWFS_RC=$?"
vnconfig -u vn0
md5 /root/poc/base.img

cp /root/poc/base.img $D/m1.img
cp /root/poc/base.img $D/m2.img
cp /root/poc/base.img $D/m3.img
md5 $D/m1.img $D/m2.img

vnconfig -c vn0 $D/m1.img
vnconfig -c vn1 $D/m2.img
mkdir -p /mnt/h2 /mnt/h2b /mnt/h2d

echo '=== 1. mount MASTER #1 (single master: 0 sync threads expected) ==='
mount -t hammer2 -o ro /dev/vn0@testvol /mnt/h2
echo "MOUNT1_RC=$?"
echo -n 'T1_h2xop='; ps axlw | grep -c h2xop-testvol
echo -n 'T1_h2nod='; ps axlw | grep -c h2nod-testvol

echo '=== 2. same-clid merge via second device (EBUSY, chains merge) ==='
mount -t hammer2 -o ro /dev/vn1@testvol /mnt/h2b
echo "MOUNT2_RC=$?"
echo -n 'T2_h2xop='; ps axlw | grep -c h2xop-testvol
echo -n 'T2_h2nod='; ps axlw | grep -c h2nod-testvol
echo '--- T2 h2nod wchan census (DEFECT: h2coll park BEFORE any umount) ---'
ps axlw | grep h2nod | grep -v grep

echo '=== 3. ls works (quorum 2/2) ==='
ls /mnt/h2
echo "LS_RC=$?"

echo '=== 4. umount -f (expect PERMANENT wedge in h2twait) ==='
date +%s > $D/ts_umount_start
( umount -f /mnt/h2 > $D/umountf.out 2>&1; echo "UMF_RC=$?" > $D/umountf.rc ) &
sleep 3
echo '--- +3s umount thread / h2nod ---'
ps axlw | grep -E "umount -f" | grep -v grep
ps axlw | grep h2nod | grep -v grep
sleep 7
echo '--- +10s ---'
ps axlw | grep -E "umount -f" | grep -v grep
ps axlw | grep h2nod | grep -v grep
sleep 55
echo '--- +65s (past one 60s tsleep cycle: still wedged = forever) ---'
ps axlw | grep -E "umount -f" | grep -v grep
ps axlw | grep h2nod | grep -v grep
echo -n 'SURV65_h2xop='; ps axlw | grep -c h2xop-testvol
cat $D/umountf.rc 2>/dev/null || echo "UMF_RC=<none - still running>"
date +%s > $D/ts_umount_end

echo '=== 5. third mount blocks on mntlk ==='
vnconfig -c vn2 $D/m3.img
( timeout 15 mount -t hammer2 -o ro /dev/vn2@testvol /mnt/h2d > $D/mount3.out 2>&1; echo "MOUNT3_RC=$?" > $D/mount3.rc ) &
sleep 8
ps axlw | grep -E "vn2@testvol" | grep -v grep
cat $D/mount3.rc 2>/dev/null
echo '=== BASELINE COMPLETE — guest wedged (recovery: reset) ==='