⬢ DragonFlyBSD Kernel Audit
DF-2660 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-2660",
  "title": "hammer2_sync_insert() re-lookup TOCTOU: KKASSERT(chain == NULL) races concurrent same-key creates",
  "verdict": "not_reproduced",
  "impact": "none",
  "confidence": "likely",
  "reproduce": {
    "build": "no compile (shell rig); build.sh pushes + syntax-checks the trigger",
    "run": "guest root: sh trigger_df2660.sh <label> <vn-base>  (e.g. j 0)",
    "expected": "stock kernel: the specific KKASSERT at synchro.c:758 was NOT reached in 4 genuine race attempts; every attempt panics first at the sibling NULL-deref hammer2_inode_chain_and_parent.cold.9+0x15 (fault va 0x118) via hammer2_chain_inode_find+0x97 from the xop unlink/lookup paths. Target assert requires the sibling defect (hammer2_inode.c:446-453) to be fixed first."
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_synchro.c:458",
    "sys/vfs/hammer2/hammer2_synchro.c:555",
    "sys/vfs/hammer2/hammer2_synchro.c:741",
    "sys/vfs/hammer2/hammer2_synchro.c:753",
    "sys/vfs/hammer2/hammer2_synchro.c:758",
    "sys/vfs/hammer2/hammer2_chain.c:113",
    "sys/vfs/hammer2/hammer2_inode.c:446",
    "sys/vfs/hammer2/hammer2_chain.c:5678",
    "sys/vfs/hammer2/hammer2_xops.c:472"
  ],
  "artifacts": [
    "VERDICT.md",
    "README.md",
    "trigger_df2660.sh",
    "build.sh",
    "run.sh",
    "build.log",
    "attempts_fghi.console.txt",
    "run_f.summary",
    "run_i.summary",
    "fix.diff",
    "fix_run.log",
    "env.txt",
    "manifest.json",
    "verdict.json"
  ]
}