⬢ DragonFlyBSD Kernel Audit
DF-5037 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "dfbsd-qemu/vm.sh reset with-src; scp -r sys/libprop + dm_abba.c guest_duel.sh into guest; kldload dm dm_target_linear; cc -O2 -Wall -I/tmp/propinc -o dm_abba dm_abba.c -lprop -lpthread",
    "run": "nohup /tmp/guest_duel.sh 90 (duel mode: P1 hammers reload of a table stacked on /dev/mapper/pbase, P2 hammers remove of the stacked device); watch dfbsd-qemu/vm.sh log",
    "expected": "both dm_abba workers freeze in D state on complementary locks (wchan dmdevlis = dm_dev_mutex, dm_dev = dmv->dev_mtx); dmsetup canaries wedge behind dm_dev_mutex; every dm ioctl hangs; 42 consecutive frozen ps snapshots captured in run.log; guest must be reset afterwards"
  },
  "kernel_refs": [
    "sys/dev/disk/dm/dm_pdev.c:128",
    "sys/dev/disk/dm/dm_pdev.c:143",
    "sys/dev/disk/dm/dm_pdev.c:168",
    "sys/dev/disk/dm/dm_pdev.c:249",
    "sys/dev/disk/dm/dm_dev.c:105",
    "sys/dev/disk/dm/dm_dev.c:66",
    "sys/dev/disk/dm/dm_dev.c:308",
    "sys/dev/disk/dm/dm_dev.c:326",
    "sys/dev/disk/dm/device-mapper.c:200",
    "sys/dev/disk/dm/dm_ioctl.c:711",
    "sys/dev/disk/dm/dm_table.c:136",
    "sys/dev/disk/dm/linear/dm_target_linear.c:67"
  ],
  "artifacts": [
    "dm_abba.c",
    "guest_duel.sh",
    "run.log",
    "ps_detail.txt",
    "run_patched.log",
    "panics_observed.txt",
    "fix.diff",
    "env.txt",
    "build.sh",
    "run.sh",
    "VERDICT.md",
    "manifest.json",
    "verdict.json"
  ]
}