⬢ DragonFlyBSD Kernel Audit
DF-3187 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
 "finding_id": "DF-3187",
 "verdict": "reproduced",
 "impact": "panic",
 "confidence": "certain",
 "reproduce": {
  "build": "cc -O -I/usr/src/sys/vfs/hammer -o trigger_scan trigger_scan.c && cc -O -o patch_dlen patch_dlen.c",
  "run": "root: vnconfig -c -S 10g /dev/vn0 h1.img; newfs_hammer -f /dev/vn0; mount_hammer /dev/vn0 /mnt; hammer pfs-master /mnt/p1; hammer synctid /mnt quick; umount /mnt; vnconfig -u vn0; ./patch_dlen h1.img -1; vnconfig -c -S 10g /dev/vn0 h1.img; mount -o ro -t hammer /dev/vn0 /mnt; chmod 755 /mnt  ||  unprivileged: ./trigger_scan /mnt 1",
  "expected": "stock kernel: Fatal trap 12 page fault in calculate_crc32c+0xf0 (kernel panic). kernel with fix.diff: ioctl returns EIO, guest stays up."
 },
 "kernel_refs": [
  "sys/vfs/hammer/hammer_pfs.c:358",
  "sys/vfs/hammer/hammer_pfs.c:363",
  "sys/vfs/hammer/hammer_btree.c:736",
  "sys/vfs/hammer/hammer_btree.c:737",
  "sys/vfs/hammer/hammer_btree.c:765",
  "sys/vfs/hammer/hammer_ondisk.c:1153",
  "sys/vfs/hammer/hammer_crc.h:274",
  "sys/vfs/hammer/hammer_ioctl.c:264",
  "sys/libkern/icrc32.c:761"
 ],
 "artifacts": [
  "README.md",
  "VERDICT.md",
  "trigger_scan.c",
  "patch_dlen.c",
  "fix.diff",
  "build.log",
  "run.log",
  "panic.txt",
  "dump_stack.txt",
  "env.txt",
  "manifest.json",
  "verdict.json"
 ],
 "code_hashes": {
  "trigger_scan.c": "f115d4659a043f7d8eb282720350784c3e3199f01c290f67a6a3eae4191225ee",
  "patch_dlen.c": "ebedbb9b423390eef9c14169627659ce434c19931a38bd93624122e254e59a2f"
 }
}