⬢ DragonFlyBSD Kernel Audit
DF-5071 / run_ab.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-5071 — fixed-variant A/B: df5071f.ko differs from df5071.ko ONLY by
# (1) an amrd_open-style AMR_STATE_SHUTDOWN fail-fast in strategy and
# (2) draining the parked bios when shutdown is entered (the hunks that go
# into sys/dev/raid/amr/{amr_disk.c,amr.c,amr_pci.c}).
# Expect: after the shutdown toggle, the held fd's read returns immediately
# r=-1 errno=6 (ENXIO) — no D-state, no parked bios.
set -e
: ${RAW:=/dev/df5071f0}
: ${CTL:=/dev/df5071fctl}

echo "== kldload fixed variant =="
kldload /tmp/poc/df5071/fixed/df5071f.ko
sleep 1

echo "== sanity: read while ONLINE completes normally =="
/tmp/poc/df5071_trigger wedge "$RAW"

echo "== wedgehold: open fd BEFORE shutdown, pread after (fixed: ENXIO) =="
/tmp/poc/df5071_trigger wedgehold "$RAW" 6 > /tmp/poc/wedge5071f.out 2>&1 < /dev/null &
WPID=$!
sleep 2

echo "== shutdown WITH FIX: drain fires =="
/tmp/poc/df5071_trigger shutdown "$CTL"

echo "== freshopen after shutdown: ENXIO (gate, unchanged) =="
/tmp/poc/df5071_trigger freshopen "$RAW"

echo "== wait for the held fd's pread: expect immediate ENXIO, no D-state =="
sleep 7
ps -o pid,stat,wchan,command -p $WPID 2>/dev/null || echo "wedgehold gone (completed)"
cat /tmp/poc/wedge5071f.out

echo "== kernel log =="
dmesg | grep 'df5071f' | tail -8

echo "== unload (clean) =="
kldunload df5071f