⬢ DragonFlyBSD Kernel Audit
DF-4473 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{
  "finding_id": "DF-4473",
  "title": "dm_table_load_ioctl mutates the inactive-table TAILQ under a SHARED table lock: concurrent reloads race TAILQ_INSERT_TAIL (list corruption -> panic / orphaned entries)",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -o dm_loadrace dm_loadrace.c -lprop -lpthread",
    "run": "./dm_loadrace 6 400 16",
    "expected": "panic: Bad tailq NEXT(0x...->tqh_last) != NULL inside dm_table_load_ioctl (QUEUEDEBUG tailq invariant), guest down"
  },
  "kernel_refs": [
    "sys/dev/disk/dm/dm_ioctl.c:722-723",
    "sys/dev/disk/dm/dm_ioctl.c:726",
    "sys/dev/disk/dm/dm_ioctl.c:774",
    "sys/dev/disk/dm/dm_table.c:59-75",
    "sys/dev/disk/dm/dm_table.c:115-123",
    "sys/sys/queue.h:628-634"
  ],
  "artifacts": [
    "dm_loadrace.c", "build.sh", "run.sh", "run.log", "panic.txt",
    "fix.diff", "env.txt", "VERDICT.md", "README.md", "manifest.json", "verdict.json"
  ]
}