⬢ DragonFlyBSD Kernel Audit
DF-3380 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
  "finding_id": "DF-3380",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cc -o /root/trigger_df3380 /root/trigger_df3380.c",
    "run": "kldload pf; ifconfig pfsync0 create; /root/trigger_df3380 lo0; sleep 10",
    "expected": "stock INVARIANTS kernel: 'panic: assertion \"LWKT_TOKEN_HELD_ANY(&pf_token)\" failed in pfsync_bulkfail at if_pfsync.c:1621' ~5s after trigger, backtrace pfsync_bulkfail<-softclock_handler, guest dead in DDB. Kernel with fix.diff: SURVIVED_CALLOUT, guest up, dmesg 'pfsync0 demoted group carp to 1'."
  },
  "kernel_refs": [
    "sys/net/pf/if_pfsync.c:1621",
    "sys/net/pf/if_pfsync.c:1164-1170",
    "sys/net/pf/if_pfsync.c:1514-1522",
    "sys/net/pf/if_pfsync.c:1552",
    "sys/net/pf/if_pfsync.c:1673",
    "sys/net/pf/if_pfsync.c:203-206",
    "sys/net/pf/if_pfsync.c:222",
    "sys/kern/kern_timeout.c:491"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "trigger_df3380.c", "build.sh", "run.sh",
    "build.log", "run.log", "run.baseline.log", "run.fixed.log", "fix_run.log",
    "fix_build.log", "build.log.final", "boot_panic_full.log", "panic.txt",
    "fix.diff", "env.txt", "verdict.json", "manifest.json"
  ]
}