⬢ DragonFlyBSD Kernel Audit
DF-2915 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "finding_id": "DF-2915",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "sh /root/sqdemo/build.sh   (modules); for test kernels: cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC && make installkernel KERNCONF=X86_64_GENERIC",
    "run": "kldload /usr/obj/tmp/sqdemo/sqprobe/sqprobe.ko   (probe, stock kernel); kldload /root/sqe2e.ko   (e2e; panics at subr_sleepqueue.c:209 on a DF-0139-masked kernel without the fix)",
    "expected": "probe: 'SQDEMO probe: 256/256 objcache_get() objects violate the KKASSERT precondition at subr_sleepqueue.c:209'; e2e (mask only): panic 'assertion \"wc->wc_wchan == NULL && wc->wc_refs == 0\" failed in sleepq_lock at /usr/src/sys/kern/subr_sleepqueue.c:209'; e2e (with fix.diff): clean lock/add/wait/broadcast round trip"
  },
  "kernel_refs": [
    "sys/kern/subr_sleepqueue.c:145",
    "sys/kern/subr_sleepqueue.c:208",
    "sys/kern/subr_sleepqueue.c:209",
    "sys/kern/subr_sleepqueue.c:212",
    "sys/kern/kern_objcache.c:386",
    "sys/kern/kern_objcache.c:571"
  ],
  "artifacts": [
    "sqprobe.c", "sqe2e.c", "Makefile.sqprobe", "Makefile.sqe2e",
    "build.sh", "run_probe.sh", "run_e2e.sh",
    "build.log", "run.log", "run.2.log",
    "panic.txt", "panic_df0139_stockkernel.txt",
    "test_df0139_mask.diff", "fix.diff",
    "kbuild2_fix2915.log", "env.txt",
    "VERDICT.md", "verdict.json", "manifest.json"
  ]
}