⬢ DragonFlyBSD Kernel Audit
DF-3067 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "finding_id": "DF-3067",
  "verdict": "reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "sh build.sh   (cc -O -o padflood padflood.c -I/usr/src/sys/vfs/hammer; truncate 12G + newfs_hammer base image)",
    "run": "sh run3067.sh  (craft all-PAD 256KB undo ring, mount in background with vfs.hammer.debug_general=0x80)",
    "expected": "mount never returns; serial console floods with 'hammer_recover_scan_rev: rev scan_offset' lines cycling through the ring (wrap 3000000000000000 -> 300000000003fff8 seen at iterations 513 and 33281 of the captured trace); mount process unkillable (kill -9 pends); guest otherwise alive"
  },
  "kernel_refs": [
    "sys/vfs/hammer/hammer_recover.c:250-270",
    "sys/vfs/hammer/hammer_recover.c:266-269",
    "sys/vfs/hammer/hammer_recover.c:312-335",
    "sys/vfs/hammer/hammer_recover.c:423-424",
    "sys/vfs/hammer/hammer_recover.c:652-670",
    "sys/vfs/hammer/hammer_recover.c:789-790",
    "sys/vfs/hammer/hammer_recover.c:901-930"
  ],
  "artifacts": [
    "padflood.c", "build.sh", "run3067.sh", "README.md", "VERDICT.md",
    "run.log", "bootlog_walk_trace.log", "console_flood_sample.txt",
    "env.txt", "fix.diff", "fix_build.log", "fix_run.log",
    "manifest.json", "verdict.json"
  ]
}