⬢ DragonFlyBSD Kernel Audit
DF-5063 / run.log
← back to finding ↓ download raw
# DF-5063 decisive run sequence (see also run.2.log, run.3.log, panic.txt)
# Guest: DragonFly 6.5-DEVELOPMENT, vinum config: drive d1 (/dev/vn0s0a),
# volume v0 up, plex p0 up, subdisks s0/s1 up.
#
# 1) df5063_setup.sh        -> SETUP_DONE, /dev/vinum/{vol/v0,plex/p0,sd/s0,sd/s1}
#    present with minors 0x00000000 / 0x50000000 / 0x60000000 / 0x60000001
#    (kernel-created nodes are RAWPLEX/RAWSD/VOLUME only -- no composite
#    VINUM_PLEX_TYPE/VINUM_SD_TYPE minors exist anywhere on the system).
#
# 2) cc -O -o /tmp/mk /tmp/df5063_mknod.c   -> build OK
#
# 3) /tmp/mk /tmp/px0 32 1342177280         -> mknod(2) OK
#    (node shows rdev 255,0xffff00ff -- NOUDEV pattern)
#
# 4) dd if=/tmp/px0 bs=512 count=1          -> GUEST PANICS
#    (Fatal trap 12, dev_dflags movq 0xa8(%rdi),%rax with rdi=0 -- NULL cdev;
#     current process dd; captured verbatim in panic.txt)
#
#    NOTE: minor 0x50000000 is a VALID, kernel-created-style rawplex minor.
#    Reading the hand-made node dies in the generic UFS->spec/devfs
#    resolution layer BEFORE vinumopen() is ever called, so the composite
#    VINUM_SD_TYPE/VINUM_PLEX_TYPE probes (0x20010000 etc.) that would
#    exercise PLEX[-1] in Sdno() can never be delivered to vinum on this
#    system.  The same panic was reproduced twice (once from the corrected
#    sweep in run.3.log's sequence, once from the isolated step above).
#
# Conclusion: composite decode paths in Plexno()/Sdno() are unreachable at
# runtime -> DF-5063 filed as Info hardening; latent PLEX[-1] OOB confirmed
# by code trace only.  The panic itself is a separate non-vinum bug
# (root-gated mknod+read DoS) flagged to the orchestrator for
# sys/vfs/devfs/devfs_vnops.c + sys/kern/vfs_subr.c.