⬢ DragonFlyBSD Kernel Audit
DF-5108 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{
  "finding_id": "DF-5108",
  "title": "lockrange() commits pos one past plex->lock[PLEX_LOCKS] when the table fills while a conflicted requester sleeps (16-byte heap OOB write + usedlocks overrun defeating the == fullness checks)",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinumlock.c:139",
    "sys/dev/raid/vinum/vinumlock.c:167",
    "sys/dev/raid/vinum/vinumlock.c:181",
    "sys/dev/raid/vinum/vinumlock.c:188",
    "sys/dev/raid/vinum/vinumlock.c:219",
    "sys/dev/raid/vinum/vinumraid5.c:592",
    "sys/dev/raid/vinum/vinumrequest.c:397",
    "sys/dev/raid/vinum/vinumconfig.c:1467"
  ],
  "trigger": "concurrent conflicting + distinct-stripe RAID-5 I/O with >=256 in-flight request groups on one plex; unprivileged via filesystem on a vinum volume",
  "artifacts": [
    "lockrange_race.c",
    "vcreate.c",
    "setup.sh",
    "ulmon.c",
    "cfg_raid5.bin",
    "cfg_raid5_pad.bin",
    "lbl_x0.bin",
    "lbl_x1.bin",
    "lbl_x2.bin",
    "lbl_d0.bin",
    "run.log",
    "fix.diff",
    "VERDICT.md",
    "manifest.json",
    "verdict.json"
  ],
  "reproduce": {
    "build": "cc -O2 -pthread -o lockrange_race lockrange_race.c && cc -O2 -o vcreate vcreate.c",
    "run": "sh setup.sh && ./lockrange_race /dev/vinum/vol/rv 800 300 270 32768",
    "expected": "on a system sustaining >=256 in-flight rangelocks with same-stripe conflicts: heap corruption past the 4 KB plex->lock allocation (panic at next unlockrange/lockrange or silent corruption of the adjacent kernel page) or uninterruptible 'vlock' sleepers; NOT achieved on this 6-vCPU guest within 3 x 300 s runs (in-flight depth ~80-160)"
  }
}