⬢ DragonFlyBSD Kernel Audit
DF-5029 / run_test.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-5029 baseline reproduction: unkillable open() on /dev/pcfclock0.
# Run as an UNPRIVILEGED user (device is 0444 root:wheel).
# Baseline (buggy) expectation:
#   - victim blocked in "ppbreq" wait channel
#   - kill -9 does NOT reap the victim while the holder keeps the bus
#   - after the holder releases, the victim finally dies / completes
set -u
cd "$(dirname "$0")"

echo "=== DF-5029 run: $(date) ==="
echo "uname: $(uname -a)"
ls -l /dev/pcfclock0

./pcf_dos hold 25 &
HOLD=$!
sleep 1

./pcf_dos victim &
VICT=$!
sleep 3

echo "--- victim state (ps) while bus held ---"
ps -o pid,ppid,stat,wchan,command | grep -E "($VICT|pcf_dos)" | grep -v grep

echo "--- kill -9 victim while bus held ---"
kill -9 $VICT 2>/dev/null
sleep 3
if kill -0 $VICT 2>/dev/null; then
    echo "RESULT: victim pid $VICT SURVIVED kill -9 (unkillable D-state sleep) [BUG REPRODUCED]"
    ps -o pid,stat,wchan,command -p $VICT
else
    echo "RESULT: victim died on kill -9 (bug NOT reproduced)"
fi

echo "--- non-blocking open while bus held (sanity: EWOULDBLOCK expected) ---"
./pcf_dos victim_nb

echo "--- waiting for holder to release (25s)... ---"
wait $HOLD 2>/dev/null
sleep 2
if kill -0 $VICT 2>/dev/null; then
    echo "post-release: victim still alive (unexpected)"
    ps -o pid,stat,wchan,command -p $VICT
else
    echo "post-release: victim reaped once the ppbus was released (pending SIGKILL delivered)"
fi

echo "--- read() on free bus: bounded EIO (documents the retry busy-wait) ---"
./pcf_dos read

echo "=== done ==="