⬢ DragonFlyBSD Kernel Audit
DF-2997 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
{
  "finding_id": "DF-2997",
  "title": "nfs_lookup/nfs_mkdir error paths vrele() LK_EXCLUSIVE-locked vnodes from nfs_nget - permanent vnode-lock leak, unkillable processes, wedged vnlru, unreclaimable vnode growth (DoS from malformed NFS server replies)",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "bucket": "base:vfs",
  "reproduce": {
    "build": "dfbsd-qemu/vm.sh run_root 'cd /root/df2997 && sh build.sh'",
    "run": "dfbsd-qemu/vm.sh run_root 'cd /root/df2997 && sh run.sh > run.raw 2>&1'   (baseline stock kernel); then apply fix.diff in guest /usr/src, make nativekernel + installkernel + reboot, sh run_fixed2.sh (fix validation); run_stocknod.sh on stock proves the umount panic pre-exists",
    "expected": "stock: every crafted reply yields errno=72 EBADRPC and permanently leaks one exclusively-locked vnode; repeat syscall on a leaked name hangs D2 wchan vnode, kill -9 ignored; 82 leaked vnodes never reclaimed (672 forever); umount -f and mount wedge in D-state; under kern.maxvnodes pressure the vnlru kernel thread wedges (wchan vnode) and cron wedges too; recovery requires reboot. patched: same errno=72 errors but vnodes reclaimed, no D-state anywhere, vnlru healthy, control mount behavior identical."
  },
  "kernel_refs": [
    "sys/vfs/nfs/nfs_node.c:129",
    "sys/vfs/nfs/nfs_node.c:163",
    "sys/vfs/nfs/nfs_node.c:216",
    "sys/vfs/nfs/nfs_vnops.c:1175",
    "sys/vfs/nfs/nfs_vnops.c:1238",
    "sys/vfs/nfs/nfs_vnops.c:1249",
    "sys/vfs/nfs/nfs_vnops.c:1251",
    "sys/vfs/nfs/nfs_vnops.c:1269",
    "sys/vfs/nfs/nfs_vnops.c:1272",
    "sys/vfs/nfs/nfs_vnops.c:2331",
    "sys/vfs/nfs/nfs_vnops.c:2346",
    "sys/vfs/nfs/nfs_vnops.c:2348",
    "sys/vfs/nfs/nfs_vnops.c:2359",
    "sys/vfs/nfs/nfs_vnops.c:2361",
    "sys/vfs/nfs/nfs_vnops.c:1083",
    "sys/vfs/nfs/nfs_vnops.c:2968",
    "sys/vfs/nfs/nfs_vnops.c:1655",
    "sys/vfs/nfs/nfsm_subs.c:287",
    "sys/vfs/nfs/nfsm_subs.c:394",
    "sys/vfs/nfs/nfsm_subs.c:412",
    "sys/vfs/nfs/nfsm_subs.c:421",
    "sys/vfs/nfs/nfsm_subs.c:493",
    "sys/kern/vfs_lock.c:571",
    "sys/kern/vfs_lock.c:589",
    "sys/kern/vfs_lock.c:345",
    "sys/kern/vfs_lock.c:380",
    "sys/kern/vfs_lock.c:783",
    "sys/kern/vfs_lock.c:890",
    "sys/kern/vfs_lock.c:1068",
    "sys/kern/vfs_lock.c:1264",
    "sys/kern/vfs_mount.c:518",
    "sys/kern/vfs_mount.c:548",
    "sys/kern/vfs_mount.c:894",
    "sys/kern/vfs_mount.c:931",
    "sys/kern/vfs_mount.c:978",
    "sys/kern/vfs_mount.c:1070",
    "sys/kern/vfs_syscalls.c:1085"
  ],
  "artifacts": [
    "fakesrv.c",
    "probe.c",
    "build.sh",
    "push.sh",
    "run.sh",
    "run_fixed2.sh",
    "run_stocknod.sh",
    "fix.diff",
    "run.raw.baseline",
    "fakesrv.log.baseline",
    "ps.now.baseline",
    "vnlru.before.baseline",
    "vnlru.after.baseline",
    "vn.now.baseline",
    "run_fixed.raw",
    "run_fixed2.raw",
    "run_stocknod.raw",
    "fakesrv2.fixed.log",
    "fakesrv3.stocknod.log",
    "panic_fixed.txt",
    "panic_stocknod.txt",
    "env.txt",
    "VERDICT.md",
    "README.md",
    "manifest.json",
    "verdict.json"
  ]
}