⬢ DragonFlyBSD Kernel Audit
DF-3152 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
{
  "finding_id": "DF-3152",
  "title": "HAMMER1 volume-add: ioc->vol_size never validated against the real device size; KKASSERT error paths and unconditional-success error overwrite (deterministic kernel panic / silent half-add)",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cc -O -I/usr/src -o voladd_lie voladd_lie.c",
    "run": "setup: vnconfig vn0=12G sparse HAMMER1 fs (newfs_hammer -f) mounted rw; vn1=2MB file. Then: ./voladd_lie /mnt/h1 /dev/vn1 2147483648",
    "expected": "console: 'Initialize freemap volume 1' then 'panic: cluster_callback: unexpected EOF on cluster ...'; guest drops to ddb>"
  },
  "kernel_refs": [
    "sys/vfs/hammer/hammer_volume.c:63",
    "sys/vfs/hammer/hammer_volume.c:103",
    "sys/vfs/hammer/hammer_volume.c:117-130",
    "sys/vfs/hammer/hammer_volume.c:616-671",
    "sys/vfs/hammer/hammer_volume.c:662-668",
    "sys/vfs/hammer/hammer_volume.c:673-739",
    "sys/vfs/hammer/hammer_volume.c:415-476",
    "sys/vfs/hammer/hammer_ondisk.c:109",
    "sys/vfs/hammer/hammer_ondisk.c:212-213",
    "sys/vfs/hammer/hammer_ondisk.c:709",
    "sys/vfs/hammer/hammer_ioctl.c:193-201"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "voladd_lie.c", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}