⬢ DragonFlyBSD Kernel Audit
DF-4532 / static_proof.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
#!/bin/sh
# DF-4532 static proof: device_busy() without a matching device_unbusy()
# on any live path in the DRM tree.
#
# Exits 0 (PROVEN) when:
#  - drm_file.c calls device_busy() in drm_open()   (the only live caller)
#  - the only device_unbusy() in sys/dev/drm is inside
#    drm_cdevpriv_dtor(), and devfs_set_cdevpriv() has no caller in
#    sys/dev/drm (i.e. that dtor can never run for drm files)
#  - drm_close()/drm_release()/drm_file_free() contain no device_unbusy
set -e
cd "$(dirname "$0")/../../.."   # repo root
[ -d sys/dev/drm ] || cd /home/maxx/dfbsd/dfbsd

echo "== all device_busy/device_unbusy sites in sys/dev/drm =="
grep -rn "device_busy\|device_unbusy" sys/dev/drm/

echo
echo "== devfs_set_cdevpriv callers in sys/dev/drm (would register the dtor) =="
if grep -rn "devfs_set_cdevpriv" sys/dev/drm/ ; then
	echo "FAIL: dtor IS registered — re-check"; exit 1
else
	echo "(none: drm_cdevpriv_dtor is dead code)"
fi

echo
echo "== device_unbusy inside drm_file.c close/release paths? =="
if grep -n "device_unbusy" sys/dev/drm/drm_file.c; then
	echo "FAIL"; exit 1
else
	echo "(none)"
fi

echo
echo "== detach refuses while DS_BUSY (why this wedges the driver) =="
sed -n '2129,2136p' sys/kern/subr_bus.c

echo
echo "PROVEN: every successful drm open() leaks one busy count; no live unbusy."