⬢ DragonFlyBSD Kernel Audit
DF-3241 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "host: bash findings/poc/DF-3241/build.sh   (pushes getfh.c/fhbomb.c/fhstat_once.c/race.sh, compiles in guest with cc)",
    "run": "guest(root): ROUNDS=6000 NBOMB=8 sh /root/poc/race.sh   (vn0 UFS image, fhstat spinners, mount/umount -f loop); host: bash findings/poc/DF-3241/run.sh",
    "expected": "stock kernel: Fatal trap 12, fault address 0x18, 'Stopped at ffs_fhtovp+0xb: movq 0x18(%rax),%r9' within seconds (baseline hit in <=3 rounds); fix-v2 kernel: 'SURVIVED 6000 rounds without panic'"
  },
  "kernel_refs": [
    "sys/vfs/ufs/ufs_vfsops.c:242-246",
    "sys/vfs/ufs/ufs_vfsops.c:210",
    "sys/vfs/ufs/ffs_vfsops.c:1215-1219",
    "sys/vfs/ufs/ffs_vfsops.c:862-866",
    "sys/kern/vfs_syscalls.c:1006",
    "sys/kern/vfs_syscalls.c:1040",
    "sys/kern/vfs_mount.c:413-424",
    "sys/vfs/nfs/nfs_subs.c:1235-1246",
    "sys/kern/kern_checkpoint.c:496"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "getfh.c", "fhbomb.c", "fhstat_once.c",
    "race.sh", "build.sh", "run.sh", "env.txt",
    "run.log", "run.fix.log", "panic.txt", "build.log", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}