DF-3140 / panic.txt
DF-3140 — unprivileged double-ftruncate -> deterministic kernel panic
Trigger: ftruncate(fd,512) x2 as uid 1001 on crafted HPFS (file TRUN)
login: hpfs_breadstruct: MAGIC DOESN'T MATCH (0x00000000 != 0x37e40aae)
panic: lockmgr: locking against myself
cpuid = 2
Trace beginning at frame 0xfffff80117f83518
lockmgr_exclusive() at lockmgr_exclusive+0x3e0 0xffffffff80647f30
lockmgr_exclusive() at lockmgr_exclusive+0x3e0 0xffffffff80647f30
getblk() at getblk+0xe1 0xffffffff806d6f91
breadnx() at breadnx+0x284 0xffffffff806d7714
hpfs_breadstruct() at hpfs_breadstruct+0x45 0xffffffff82603735
hpfs_truncatealblk() at hpfs_truncatealblk+0xf2 0xffffffff82604592
Debugger("panic")
CPU2 stopping CPUs: 0x0000003b
stopped
Stopped at Debugger+0x7c: movb $0,0xbdaf09(%rip)
db>