⬢ DragonFlyBSD Kernel Audit
DF-2851 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "finding_id": "DF-2851",
  "title": "netmsg_so_notify abort race: accept predicate mutates nm_so while abortable -> unserialized abort on wrong socket (wrong-list TAILQ_REMOVE / illegal token release / double reply)",
  "file": "sys/kern/uipc_msg.c",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O2 -pthread -Wall -o /tmp/accept_abort_race /tmp/accept_abort_race.c",
    "run": "/tmp/accept_abort_race 240",
    "expected": "kernel panic 'lwkt_reltoken: illegal release' with netmsg_so_notify_abort in the backtrace within seconds-to-minutes (unprivileged); with fix.diff applied: no panic over 2x240s"
  },
  "kernel_refs": [
    "sys/kern/uipc_msg.c:702-715",
    "sys/kern/uipc_msg.c:744-751",
    "sys/kern/uipc_syscalls.c:244-262",
    "sys/kern/uipc_socket2.c:616-630",
    "sys/kern/lwkt_token.c:816-823"
  ],
  "fix_status": "fixed",
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "accept_abort_race.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "panic.txt",
    "panic_run2.txt",
    "boot_full.txt",
    "boot_full_run2.txt",
    "fixrun.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}