⬢ DragonFlyBSD Kernel Audit
DF-3140 / panic.txt
← back to finding ↓ download raw
DF-3140 — unprivileged double-ftruncate -> deterministic kernel panic
Trigger: ftruncate(fd,512) x2 as uid 1001 on crafted HPFS (file TRUN)



login: hpfs_breadstruct: MAGIC DOESN'T MATCH (0x00000000 != 0x37e40aae)
panic: lockmgr: locking against myself
cpuid = 2
Trace beginning at frame 0xfffff80117f83518
lockmgr_exclusive() at lockmgr_exclusive+0x3e0 0xffffffff80647f30 
lockmgr_exclusive() at lockmgr_exclusive+0x3e0 0xffffffff80647f30 
getblk() at getblk+0xe1 0xffffffff806d6f91 
breadnx() at breadnx+0x284 0xffffffff806d7714 
hpfs_breadstruct() at hpfs_breadstruct+0x45 0xffffffff82603735 
hpfs_truncatealblk() at hpfs_truncatealblk+0xf2 0xffffffff82604592 
Debugger("panic")

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>