⬢ DragonFlyBSD Kernel Audit
DF-3073 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
  "finding_id": "DF-3073",
  "title": "nfs_unmount frees the nfsmount after a failed forced vflush (busy device vnode) - use-after-free condition + deterministic 'unmount: dangling vnode' panic",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "sh /root/df3073/build.sh",
    "run": "sh /root/df3073/run.sh",
    "expected": "phase A: clean forced unmount; phase B: 'Device busy'; phase C: ~13s retry loop then console 'vflush: Warning, cannot destroy busy device vnode' + 'NFS inodes: ... 1 objects were still allocated' + 'panic: unmount: dangling vnode' (dounmount+0x87c). Patched kernel: phase C returns EBUSY, guest alive."
  },
  "kernel_refs": [
    "sys/vfs/nfs/nfs_vfsops.c:1217-1224",
    "sys/vfs/nfs/nfs_vfsops.c:1232-1243",
    "sys/vfs/nfs/nfs_vfsops.c:1248-1262",
    "sys/kern/vfs_mount.c:1145-1146",
    "sys/kern/vfs_mount.c:1194",
    "sys/kern/vfs_syscalls.c:1085-1086",
    "sys/vfs/nfs/nfs_node.c:383-387",
    "sys/vfs/nfs/nfs_node.c:439,485"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "fakesrv2.c",
    "holder.c",
    "holder2.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "run.fixed.log",
    "panic.txt",
    "fixed.console.txt",
    "env.txt",
    "fix.diff",
    "verdict.json",
    "manifest.json"
  ]
}