⬢ DragonFlyBSD Kernel Audit
DF-2661 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-2661",
  "title": "hammer2 DIO error path leaves stale dio->bp with DIO_GOOD cleared; concurrent accessor panics (KKASSERT dio->bp == NULL)",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "kernel A: sh build.sh (stock+inject.diff); kernel B: sh build_fix.sh (stock+inject.diff+fix_b.diff); kernel C: sh ../DF-2662/build_fix.sh (adds DF-2662 fix.diff); make -j6 nativekernel in guest /usr/src",
    "run": "sh /root/df2661/trigger_df2661.sh golden; sh /root/df2661/trigger_df2661.sh 5 (ARM=0 for the no-EIO control)",
    "expected": "kernel A: panic 'assertion \"dio->bp == NULL\" failed in _hammer2_io_getblk at hammer2_io.c:264' (stock :254), guest wedged in ddb; kernel B: dio assert gone (crash moves to DF-2662); kernel C: ROUND_SURVIVED x5 + ALL_ROUNDS_SURVIVED"
  },
  "kernel_refs": [
    "sys/vfs/hammer2/hammer2_io.c:254",
    "sys/vfs/hammer2/hammer2_io.c:350-356",
    "sys/vfs/hammer2/hammer2_io.c:361-373",
    "sys/vfs/hammer2/hammer2_io.c:458-512",
    "sys/vfs/hammer2/hammer2_chain.c:985-1006",
    "sys/kern/vfs_bio.c:905-907"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "env.txt",
    "inject.diff", "fix.diff", "fix_b.diff",
    "trigger_df2661.sh", "build.sh", "build_fix.sh", "run.sh",
    "build.log", "buildB.log", "fix_build.log", "fix_run.log",
    "run.log", "run_baseline.txt", "panic.txt",
    "manifest.json", "verdict.json"
  ]
}