DragonFlyBSD Kernel Audit
DF-2686 / run_baseline.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2686 setup + baseline run (run as root in the guest).
# Builds the loopback soft-NFS environment, runs the victim, kills the
# server mid-window, and shows the permanent D-state hang (stock kernel).
#
# STOCK expectation:
#   dmesg: "vm_fault: pager read error, pid N (victim)"
#          "warning: refcount_wait objtrm1: long wait"  (repeats every 60s)
#   ps:    <pid> D1E  objtrm1  victim: victimproc        (stuck forever)
# PATCHED expectation (fix.diff):
#   fault still surfaces an error (SIGBUS/EIO path) but the process exits
#   cleanly; no objtrm1 wchan, no long-wait warnings.
set -e
mkdir -p /export /mnt2 /tmp/mt
[ -f /export/data.bin ] || { dd if=/dev/urandom of=/export/data.bin bs=4k seek=4096 count=1 2>/dev/null; chmod 666 /export/data.bin; }
printf "/export -mapall=root localhost\n" > /etc/exports
pkill -9 "^nfsd$" 2>/dev/null || true; pkill -9 "^mountd$" 2>/dev/null || true; pkill -9 "^rpcbind$" 2>/dev/null || true
sleep 1
rpcbind; sleep 1; mountd; sleep 1; /sbin/nfsd; sleep 2
rpcinfo -p localhost | grep -c nfs
umount /mnt2 2>/dev/null || true
timeout 25 mount -t nfs -o soft,udp localhost:/export /mnt2
cc -O2 -o /tmp/mt/victim victim.c -lutil
cc -O2 -o /tmp/mt/wrapper wrapper.c
(/tmp/mt/wrapper /tmp/mt/victim; echo "WRAPPER_DONE=$?") > /tmp/mt/run.log 2>&1 &
sleep 4
grep -q READY /tmp/mt/run.log && echo "victim READY; killing NFS server"
pkill -9 "^nfsd$"; pkill -9 "^mountd$"; pkill -9 "^rpcbind$"
sleep 95
echo "=== ps (stock: victim stuck D objtrm1) ==="
ps -axo pid,stat,wchan,comm | grep -E "objtrm|victim" | grep -v grep || echo "no hang (clean)"
echo "=== run.log ==="; cat /tmp/mt/run.log
echo "=== dmesg tail ==="; dmesg | tail -8