⬢ DragonFlyBSD Kernel Audit
DF-5563 / run_f2.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-5564 baseline reproduction: IIC_WAIT-only requester sleeps without
# PCATCH and timeout 0 (iiconf.c:66-68) -- kill -9 is IGNORED while it
# is parked; it only proceeds when some other iicbus child cycles the
# bus (release -> wakeup(sc)).  Non-destructive.
set -e
cd /root/df5563

echo "=== load chain ==="
kldload /usr/src/sys/bus/iicbus/iicbus/iicbus.ko
kldload /boot/kernel/iicbb.ko
kldload /usr/obj/root/df5563/build_reg/iicbb_reg.ko
kldload /usr/obj/root/df5563/build_rig/df5563_rig.ko
sleep 1

echo "=== park a WAIT-only requester (the ipmi_ssif/cyapa contract) ==="
sysctl hw.df5563.busy=1
./park wait &
PARK=$!
sleep 2
ps -o pid,stat,wchan,command -p $PARK || true

echo "=== kill -9 it ==="
kill -9 $PARK
sleep 3
if ps -o pid,stat,wchan -p $PARK >/dev/null 2>&1; then
	echo "UNEXPECTED-SURVIVAL-OK: process still alive after SIGKILL"
else
	echo "process died (PCATCH present -- finding NOT reproduced)"
fi

echo "=== a non-owner release must NOT wake it (EACCES path has no wakeup) ==="
./park rel || true
sleep 1
ps -o pid,stat,wchan -p $PARK || true

echo "=== another child acquiring+releasing the bus wakes it ==="
sysctl hw.df5563.busy=0
./park intr || true
sleep 3
ps -o pid,stat,wchan,command -p $PARK || echo "park process finally gone (woken by wakeup(sc))"