⬢ DragonFlyBSD Kernel Audit
DF-3040 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-3040",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "sh build.sh   (cc -O -o undo_craft undo_craft.c -I/usr/src/sys/vfs/hammer; newfs_hammer -L uabase on a 12G sparse vn)",
    "run": "sh run.sh 0x4000000000",
    "expected": "Fatal trap 12 page fault at hammer_undo_lookup+0x84 addq 0x388(%rcx,%rdx,8),%rbx — guest wedged at db> (kernel panic, mount never completes)"
  },
  "kernel_refs": [
    "sys/vfs/hammer/hammer_ondisk.c:688-689",
    "sys/vfs/hammer/hammer_ondisk.c:703",
    "sys/vfs/hammer/hammer_undo.c:58-76",
    "sys/vfs/hammer/hammer_disk.h:512",
    "sys/vfs/hammer/hammer_disk.h:789",
    "sys/vfs/hammer/hammer_disk.h:824-829",
    "sys/vfs/hammer/hammer_recover.c:232",
    "sys/vfs/hammer/hammer_recover.c:257-263",
    "sys/vfs/hammer/hammer_recover.c:798",
    "sys/vfs/hammer/hammer_vfsops.c:671"
  ],
  "artifacts": [
    "undo_craft.c", "build.sh", "run.sh", "freemap_probe.sh",
    "run.log", "panic_idx2048.txt", "panic_idx32768.txt",
    "fix.diff", "fix_build.log", "fix_run.log",
    "README.md", "VERDICT.md", "manifest.json", "verdict.json", "env.txt"
  ],
  "fix_summary": "hammer_undo_lookup(): reject zone3_off >= HAMMER_ENCODE_UNDO(HAMMER_MAX_UNDO_BIGBLOCKS * HAMMER_BIGBLOCK_SIZE) with EIO before hammer_xlate_to_undo()"
}