⬢ DragonFlyBSD Kernel Audit
DF-3093 / run3.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-3093 run v3: force clusteralloc() through its two-pass fallback scan
# (the wide unsynchronized window) by pre-fragmenting the volume into
# 2048-cluster free runs, then racing barrier-synchronized 16 MiB
# (4096-cluster) writes from 6 CPU-pinned processes.  Detection: offline
# FAT in-degree scan (fat_scan) after every cycle + foreign bytes.
#
# geometry: 2g image, 4 KiB clusters, 523262 clusters.
#   setup: 128 x 8 MiB files (2048-cluster runs each), delete the odd
#   ones -> 64 free runs of 2048 clusters, no run >= 4096 clusters, so
#   every clusteralloc(count=4096) takes the full-map fallback scan.
#
# usage: run3.sh [cycles] [procs] [rounds] [chunk]
set -u
ID=DF-3093
MNT=/mnt/df3093
VND=vn0
IMG=/root/df3093.img
CYCLES=${1:-3}
PROCS=${2:-6}
ROUNDS=${3:-5}
CHUNK=${4:-16777216}
DIR="$(dirname "$0")"

cleanup() {
	umount $MNT 2>/dev/null || true
	vnconfig -u $VND 2>/dev/null || true
}
trap cleanup EXIT

cd "$DIR" || exit 1
cc -O2 -o race2 race2.c || exit 1
cc -O2 -o fat_scan fat_scan.c || exit 1

c=1
while [ $c -le $CYCLES ]; do
	echo "=== cycle $c/$CYCLES: fragment + race ${PROCS}p x ${ROUNDS}r x ${CHUNK}B ==="
	cleanup
	rm -f $IMG
	newfs_msdos -C 2g -c 8 $IMG >/dev/null 2>&1 || { echo newfs fail; exit 1; }
	vnconfig -c $VND $IMG
	mkdir -p $MNT
	mount_msdos -m 644 /dev/$VND $MNT || { echo mount fail; exit 1; }

	# build the alternating used/free pattern
	i=0
	while [ $i -lt 128 ]; do
		dd if=/dev/zero of=$MNT/F$(printf %03d $i) bs=1m count=8 \
		    >/dev/null 2>&1
		i=$((i + 1))
	done
	i=1
	while [ $i -lt 128 ]; do
		rm -f $MNT/F$(printf %03d $i)
		i=$((i + 2))
	done
	echo "fragmented: $(df $MNT | tail -1 | awk '{print $4}') 512B-secs free"

	./race2 $MNT $PROCS $ROUNDS $CHUNK 1
	sync
	umount $MNT
	vnconfig -u $VND
	if ./fat_scan $IMG; then
		:
	else
		echo "=== CYCLE $c: FAT SCAN FOUND CROSS-LINKS ==="
		cp $IMG /root/df3093-hit-$c.img
		exit 42
	fi
	dmesg | tail -20 | grep -i "Freeing unused sector" && {
		echo "=== kernel: 'Freeing unused sector' ==="; exit 43; }
	c=$((c + 1))
done
echo "RESULT $ID: no cross-link detected in $((c - 1)) cycles"