⬢ DragonFlyBSD Kernel Audit
DF-5328 / race_alloc.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
#!/bin/sh
# DF-5328 bounded statistical race attempt: drive periph create/destroy
# cycles on the ch target while an fd churns opens/closes, trying to hit
# cam_periph_alloc()'s find()->flag-store window with camperiphfree().
#   T1: loop { open /dev/ch0 (parked via defer -> immediately released),
#               close }
#   T2: loop { invalidate target; rescan target }
# Detection: guest panic/crash, or 'chasync: Unable to probe' spam, or
# dmesg anomalies.  Bounded to ~90s; see VERDICT.md for the honest result.
set -e
cd /root/df5327
sysctl -n debug.evilcd.watch=2 >/dev/null

( i=0
  while [ $i -lt 400 ]; do
	i=$((i+1))
	./race_fdchurn >/dev/null 2>&1 || true
  done ) &
P1=$!

( i=0
  while [ $i -lt 200 ]; do
	i=$((i+1))
	sysctl -n debug.evilcd.invalidate=1 >/dev/null 2>&1 || true
	sysctl -n debug.evilcd.rescan=1 >/dev/null 2>&1 || true
	sleep 0.15
  done ) &
P2=$!

wait $P1 $P2 || true
echo "race loops done; refcnt=$(sysctl -n debug.evilcd.refcnt)"
dmesg | tail -5