DF-3012 / manifest.json
{ "finding_id": "DF-3012", "verdict": "not_reproduced", "impact": "none", "confidence": "likely", "reproduce": { "build": "cc -O -o /tmp/op3012 /tmp/op3012.c -Wall", "run": "sh /tmp/run3012.sh (in-guest as root: fresh 512M HAMMER1 fs on vn0, nohistory; attacker writers run as nobody; watches dmesg 'reservation failed' + vmstat -m HAMMER-others)", "expected": "when a hammer_blockmap_reserve() failure occurs at strategy time: one 'hammer_ip_add_bulk: reservation failed' dmesg line per leaked record and monotonic, permanent growth of the HAMMER-others malloc zone. On the lab guest (default and reduced tuning) zero reservation failures were achievable -- see VERDICT.md/EXPERIMENTS.md" }, "kernel_refs": [ "sys/vfs/hammer/hammer_object.c:974", "sys/vfs/hammer/hammer_object.c:711", "sys/vfs/hammer/hammer_object.c:363", "sys/vfs/hammer/hammer_vnops.c:3251", "sys/vfs/hammer/hammer_blockmap.c:419", "sys/vfs/hammer/hammer_blockmap.c:1267", "sys/vfs/hammer/hammer_io.c:1793" ], "artifacts": [ "README.md", "VERDICT.md", "EXPERIMENTS.md", "op3012.c", "probe.c", "writers.sh.harness", "build.sh", "run.sh", "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json" ] } |