⬢ DragonFlyBSD Kernel Audit
DF-2717 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
{
  "finding_id": "DF-2717",
  "verdict": "not_reproduced",
  "impact": "none",
  "confidence": "likely",
  "reproduce": {
    "build": "cc -O2 -pthread -o df2717_storm df2717_storm.c && cc -O2 -o bench_open bench_open.c",
    "run": "./df2717_storm 90 3 0xf    (as unprivileged user; attribution: 0x9 150s, 0xc 120s, 0xe 60s)",
    "expected": "Attribution sub-storms for the DF-2717 primitives (torn pair, hold-after-drop) run CLEAN: no assertion, no panic, guest stays up. The FULL mix (0xf) panics the stock INVARIANTS kernel 3/3 within 90 s at nlookup+0x66c (vfs_nlookup.c:767) via the adjacent NULL-nc_parent bug; the patched kernel survives 2x150 s of the same storm with no panic."
  },
  "kernel_refs": [
    "sys/kern/vfs_nlookup.c:149",
    "sys/kern/vfs_nlookup.c:159",
    "sys/kern/vfs_nlookup.c:225",
    "sys/kern/vfs_nlookup.c:242",
    "sys/kern/vfs_nlookup.c:756",
    "sys/kern/vfs_nlookup.c:767",
    "sys/kern/vfs_nlookup.c:1376",
    "sys/kern/vfs_cache.c:1006",
    "sys/kern/vfs_cache.c:1023",
    "sys/kern/vfs_cache.c:763",
    "sys/kern/vfs_cache.c:766",
    "sys/kern/vfs_syscalls.c:1906",
    "sys/kern/vfs_syscalls.c:2059",
    "sys/kern/kern_descrip.c:2411"
  ],
  "artifacts": [
    "df2717_storm.c",
    "bench_open.c",
    "build.sh",
    "run.sh",
    "build.log",
    "smoke.log",
    "run-S1-swap-only.log",
    "run-S2-dance-only.log",
    "run-S3-full-panic.log",
    "panic-smoke-console.txt",
    "panic-2-console.txt",
    "kgdb-bt.log",
    "kgdb-frame6-locals.log",
    "bench-stock.log",
    "bench-fixed.log",
    "run-fixed-storm.log",
    "buildkernel-fixed.log",
    "env.txt",
    "fix.diff",
    "VERDICT.md",
    "manifest.json",
    "verdict.json"
  ]
}