⬢ DragonFlyBSD Kernel Audit
DF-5151 / run.2.log
← back to finding ↓ download raw 
+ DM_KO=dm
+ kldload dm
+ kldload dm_target_linear
+ ls -l /dev/mapper/control
crw-r-----  1 root  operator   32, 0x00000000 Sep 30 11:29 /dev/mapper/control
+ mkdir -p /tmp/dmtr
+ ln -sf /dev/md0 /tmp/dmtr/aaaaaaaaaaaaaaaaaaaaa
+ ln -sf /dev/md0s0 /tmp/dmtr/aaaaaaaaaaaaaaaaaaaaabb
+ ls -l /tmp/dmtr/
total 16
lrwxr-xr-x  1 root  wheel   8 Sep 30 11:29 aaaaaaaaaaaaaaaaaaaaa -> /dev/md0
lrwxr-xr-x  1 root  wheel  10 Sep 30 11:29 aaaaaaaaaaaaaaaaaaaaabb -> /dev/md0s0
+ ls -l /dev/md0 /dev/md0s0
crw-r-----  1 root  operator    4, 0x1e110007 Sep 30 11:29 /dev/md0
crw-r-----  1 root  operator    4, 0x1e100007 Sep 30 11:29 /dev/md0s0
+ ls -l /dev/md0
+ sed -n 's/.*0x\([0-9a-f]*\).*/\1/p'
+ YDEV=1e110007
+ ./poc_dm_pdev_trunc 0x1e110007
sizeof(plistref)=16 (kernel expects 16)
strlen(T_PATH)=31  (must be 31)
strlen(L_PATH)=33  (stored pdev name := first 31 chars of L)
expected deps(dfb) if correct = 0x1e110007
---- create response ----
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>command</key>
	<string>create</string>
	<key>flags</key>
	<integer>0x4</integer>
	<key>minor</key>
	<integer>0x1e110007</integer>
	<key>name</key>
	<string>dfa</string>
	<key>version</key>
	<array>
		<integer>0x4</integer>
		<integer>0x10</integer>
		<integer>0x0</integer>
	</array>
</dict>
</plist>

---- create response ----
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>command</key>
	<string>create</string>
	<key>flags</key>
	<integer>0x4</integer>
	<key>minor</key>
	<integer>0x1e11000f</integer>
	<key>name</key>
	<string>dfb</string>
	<key>version</key>
	<array>
		<integer>0x4</integer>
		<integer>0x10</integer>
		<integer>0x0</integer>
	</array>
</dict>
</plist>

---- create response ----
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>command</key>
	<string>create</string>
	<key>flags</key>
	<integer>0x4</integer>
	<key>minor</key>
	<integer>0x1e110017</integer>
	<key>name</key>
	<string>dfc</string>
	<key>version</key>
	<array>
		<integer>0x4</integer>
		<integer>0x10</integer>
		<integer>0x0</integer>
	</array>
</dict>
</plist>

---- reload response ----
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>cmd_data</key>
	<array>
		<dict>
			<key>length</key>
			<integer>32</integer>
			<key>params</key>
			<string>/tmp/dmtr/aaaaaaaaaaaaaaaaaaaaabb 0</string>
			<key>start</key>
			<integer>0</integer>
			<key>type</key>
			<string>linear</string>
		</dict>
	</array>
	<key>command</key>
	<string>reload</string>
	<key>flags</key>
	<integer>0x40</integer>
	<key>minor</key>
	<integer>0x1e110007</integer>
	<key>name</key>
	<string>dfa</string>
	<key>version</key>
	<array>
		<integer>0x4</integer>
		<integer>0x10</integer>
		<integer>0x0</integer>
	</array>
</dict>
</plist>

---- reload response ----
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>cmd_data</key>
	<array>
		<dict>
			<key>length</key>
			<integer>32</integer>
			<key>params</key>
			<string>/tmp/dmtr/aaaaaaaaaaaaaaaaaaaaa 0</string>
			<key>start</key>
			<integer>0</integer>
			<key>type</key>
			<string>linear</string>
		</dict>
	</array>
	<key>command</key>
	<string>reload</string>
	<key>flags</key>
	<integer>0x40</integer>
	<key>minor</key>
	<integer>0x1e11000f</integer>
	<key>name</key>
	<string>dfb</string>
	<key>version</key>
	<array>
		<integer>0x4</integer>
		<integer>0x10</integer>
		<integer>0x0</integer>
	</array>
</dict>
</plist>

==== control: reload with nonexistent path (expect FAILURE) ====
reload dfc (/tmp/dmtr/no-such-device-node): ioctl FAILED with errno=2 (No such file or directory)
---- resume response ----
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>command</key>
	<string>resume</string>
	<key>flags</key>
	<integer>0x4</integer>
	<key>minor</key>
	<integer>0x1e110007</integer>
	<key>name</key>
	<string>dfa</string>
	<key>open_count</key>
	<integer>0x0</integer>
	<key>version</key>
	<array>
		<integer>0x4</integer>
		<integer>0x10</integer>
		<integer>0x0</integer>
	</array>
</dict>
</plist>

---- resume response ----
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>command</key>
	<string>resume</string>
	<key>flags</key>
	<integer>0x4</integer>
	<key>minor</key>
	<integer>0x1e11000f</integer>
	<key>name</key>
	<string>dfb</string>
	<key>open_count</key>
	<integer>0x0</integer>
	<key>version</key>
	<array>
		<integer>0x4</integer>
		<integer>0x10</integer>
		<integer>0x0</integer>
	</array>
</dict>
</plist>

---- deps response ----
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>cmd_data</key>
	<array>
		<integer>504365063</integer>
	</array>
	<key>command</key>
	<string>deps</string>
	<key>flags</key>
	<integer>0</integer>
	<key>minor</key>
	<integer>0x1e110007</integer>
	<key>name</key>
	<string>dfa</string>
	<key>uuid</key>
	<string/>
	<key>version</key>
	<array>
		<integer>0x4</integer>
		<integer>0x10</integer>
		<integer>0x0</integer>
	</array>
</dict>
</plist>

---- deps response ----
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>cmd_data</key>
	<array>
		<integer>504365063</integer>
	</array>
	<key>command</key>
	<string>deps</string>
	<key>flags</key>
	<integer>0</integer>
	<key>minor</key>
	<integer>0x1e11000f</integer>
	<key>name</key>
	<string>dfb</string>
	<key>uuid</key>
	<string/>
	<key>version</key>
	<array>
		<integer>0x4</integer>
		<integer>0x10</integer>
		<integer>0x0</integer>
	</array>
</dict>
</plist>


==== RESULT ====
deps(dfa [path L -> /dev/md0s0]) = 0x1e100007
deps(dfb [path T -> /dev/md0   ]) = 0x1e100007

MISDIRECTION PROVEN (BUG PRESENT): dfb's table (loaded
with a path resolving to /dev/md0) is bound to the pdev
of dfa (/dev/md0s0). The truncated 31-char dedup key
strcmp-matched.
poc exit=0
+ echo 'poc exit=0'
+ rm -f /tmp/dmtr/aaaaaaaaaaaaaaaaaaaaa /tmp/dmtr/aaaaaaaaaaaaaaaaaaaaabb
+ kldunload dm_target_linear
+ kldunload dm