DF-3235 / leak_sample.txt
DF-3235 leak samples: torn reads of /proc/<victim>/cmdline returning the FILLER process's argv bytes out of a recycled (freed) kernel M_PARGS chunk. The victim's argv alphabet contains only: "/home/maxx/racer", "victim", "A", 'A'-padding. The bytes 'F'*runs and the tail below the tear are the filler's argv pad (MARKER + 'F's). No legitimate read of /proc/<victim>/cmdline can ever return 'F' bytes. === run.12.log (stock kernel #0) - torn read #1 === [reader 2242] ANOMALY: 184B 8.00ms: /home/maxx/racer.victim.A.AAAA...AAAAFFFF.FFF. (tear at ~byte 134) === run.13.log (stock kernel #0) - torn read #2 (hit criterion) === [reader 2271] HIT: 184B 4.62ms: /home/maxx/racer.victim.A.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF. === run.15.log (stock kernel #0) - torn reads #3 and #4 === [reader 2308] ANOMALY: 184B 3.38ms: /home/maxx/racer.victim.A.AAAA...AAAAFF. (tear at ~byte 182) [reader 2309] HIT: 184B 5.27ms: /home/maxx/racer.victim.A.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF. === patched kernel #1 (fix.diff applied): 2 x 300s runs, zero anomalies === run.fix.1.log: args=2241/2235 (slow=2241/2235) anom=0, RESULT: no hit run.fix.2.log: args=9592/9551 (slow=9592/9551) anom=0, RESULT: no hit (every one of those p_args reads blocked ms-scale in the copyout fault - the race window was wide open - yet zero torn/reused bytes came back)