DragonFlyBSD Kernel Audit
DF-2672 / run.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2672 - vm_object reference leak on fork() of wired (mlock'd) entries.
#
# Metrics:
#   1) vmstat -m "vm_object" Count  (humanized; large permanent delta = leak)
#   2) swapinfo Used 512-blocks     (leaked dirty anon pages can never be
#                                     freed once paged out -> permanent swap)
# Phase 1 control: dirty+mlock, NO fork   -> swap fully returns
# Phase 2 leak   : dirty+mlock + fork     -> swap permanently consumed
set -e
objcount() { vmstat -m | awk '$1=="vm_object"{print $2}'; }
swused()   { swapinfo | tail -1 | awk '{print $3}'; }

cc -O2 -o /tmp/hog /root/poc/DF-2672/hog.c

echo "== baseline =="
echo "vm_object count: $(objcount)   swap used(512B): $(swused)"

echo "== phase 1 CONTROL: 100 x 4MB, dirty+mlock, NO fork =="
/tmp/leak_fork 100 4194304 control
/tmp/hog 3200 >/dev/null 2>&1 || true
sleep 2
echo "vm_object count: $(objcount)   swap used(512B): $(swused)"

echo "== phase 2 LEAK: 200 x 4MB, dirty+mlock + fork =="
/tmp/leak_fork 200 4194304 leak
echo "vm_object count: $(objcount)   swap used(512B): $(swused)"
echo "== pressure =="
/tmp/hog 3200 >/dev/null 2>&1 || true
sleep 2
echo "vm_object count: $(objcount)   swap used(512B): $(swused)  <-- after pressure, no processes own anon mem"