⬢ DragonFlyBSD Kernel Audit
DF-3169 / run_kthread.log
← back to finding ↓ download raw
vfs.autofs.timeout: 30 -> 1
vfs.autofs.retry_attempts: 3 -> 12
vfs.autofs.retry_delay: 1 -> 2
vfs.autofs.interruptible: 1 -> 0
vfs.autofs.debug: 1 -> 0
df3169 on /df3169_mp (autofs)
KLDRC=0
DF3169: harness loaded, scanning for autofs mount...
DF3169: mp=0xfffff8008dcd6800 amp=0xfffff8008d4be800 root anp=0xfffff8008d3cd700 last_request_id=0 (sizeof autofs_mount=4288 autofs_node=256)
DF3169: calling dounmount(MNT_FORCE) (ticks=15741)
DF3169: dounmount returned 0 (ticks=15842) -- anp=0xfffff8008d3cd700 amp=0xfffff8008d4be800 ARE FREED NOW
DF3169: reuse blocks: amp 0xfffff8008d4be800 (freed amp was 0xfffff8008d4be800) SAME-BLOCK, node 0xfffff8008d3cd700 (freed anp was 0xfffff8008d3cd700) SAME-BLOCK
DF3169 POLL: freed anp=0xfffff8008d3cd700 an_retries: -1 -> 1 (ticks=15845)
DF3169: DANGLING REQUEST ar=0xfffff80089942e00 id=1 ar_mount=0xfffff8008d4be800 == FREED amp (ticks=15945, dounmount_ticks=15842)
DF3169:   ar_from="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"...
DF3169:   ar_path="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"...
DF3169 POLL: freed anp=0xfffff8008d3cd700 an_retries: 1 -> 2 (ticks=16047)  <== WRITE-AFTER-FREE
DF3169 POLL: freed anp=0xfffff8008d3cd700 an_retries: 2 -> 3 (ticks=16349)  <== WRITE-AFTER-FREE
DF3169 POLL: freed anp=0xfffff8008d3cd700 an_retries: 3 -> 4 (ticks=16651)  <== WRITE-AFTER-FREE
DF3169 POLL: freed anp=0xfffff8008d3cd700 an_retries: 4 -> 5 (ticks=16943)  <== WRITE-AFTER-FREE
DF3169 POLL: freed anp=0xfffff8008d3cd700 an_retries: 5 -> 6 (ticks=17246)  <== WRITE-AFTER-FREE
DF3169 POLL: freed anp=0xfffff8008d3cd700 an_retries: 6 -> 7 (ticks=17547)  <== WRITE-AFTER-FREE
DF3169 POLL: freed anp=0xfffff8008d3cd700 an_retries: 7 -> 8 (ticks=17848)  <== WRITE-AFTER-FREE
DF3169 POLL: freed anp=0xfffff8008d3cd700 an_retries: 8 -> 9 (ticks=18150)  <== WRITE-AFTER-FREE
DF3169 POLL: freed anp=0xfffff8008d3cd700 an_retries: 9 -> 10 (ticks=18442)  <== WRITE-AFTER-FREE
DF3169 POLL: freed anp=0xfffff8008d3cd700 an_retries: 10 -> 11 (ticks=18744)  <== WRITE-AFTER-FREE
DF3169 W: trigger returned 60 (ticks=19042, dounmount_ticks=15842)
DF3169: SUMMARY dounmount_ticks=15842 dangling=1 last_request_id 0 -> 12 (ids > 0 were created during/after the forced unmount)
DF3169: test complete; guest still up (UAF exercised on reused blocks; no crash by design of the probe).
BASELINE-DONE