DF-3218 / manifest.json
{ "finding_id": "DF-3218", "verdict": "reproduced", "impact": "panic", "reproduce": { "build": "see README.md: nativekernel KERNCONF=VKDIRFS (VKERNEL64 + options DIRFS) inside the guest, after the documented bit-rot include fixes; root image with minimal userland", "run": "sh /tmp/vkpoc2.sh (pack: run.sh) \u2014 boots vkernel, mounts dirfs from /dirfs-host, swaps it to a dangling symlink, then: ls /hostroot", "expected": "baseline: Fatal trap 12, fault VA 0x128, Stopped at movq $0,0x128(%r13) in dirfs_free_vp; fixed: ls: /hostroot: No such file or directory, vkernel alive" }, "kernel_refs": [ "sys/vfs/dirfs/dirfs_vfsops.c:246", "sys/vfs/dirfs/dirfs_vfsops.c:250", "sys/vfs/dirfs/dirfs_vfsops.c:258", "sys/vfs/dirfs/dirfs_vfsops.c:261", "sys/vfs/dirfs/dirfs_vfsops.c:262", "sys/vfs/dirfs/dirfs_subr.c:300", "sys/vfs/dirfs/dirfs_subr.c:305", "sys/vfs/dirfs/dirfs_subr.c:96" ], "artifacts": [ "run.baseline.log", "run.fixed.log", "run.driver-output.log", "run.driver-output-fixed.log", "run.sh", "vkmount.c", "vkinit.c", "applyfix.sh", "fix.diff", "build.log", "build.vkernel-full.log", "fix-build.log", "env.txt", "VERDICT.md", "manifest.json", "verdict.json" ] } |