DF-5632 / run_c_panic.sh
#!/bin/sh # RUN-C: STOCK iicbus.ko, DF-5635 -- swallowed child-detach failure # leaves a driverless NULL-softc iicbus0 with an attached child; the # child's next iicbus_request_bus() derefs NULL. EXPECTED: kernel # panic (Fatal trap 12, fault address ~0x8) at iiconf.c:101. set -e cd /root/df5632 echo "=== load stock chain ===" kldload /boot/kernel/iicbus.ko kldload /boot/kernel/iicbb.ko kldload /usr/obj/root/df5632/build_reg/iicbb_reg.ko kldload /usr/obj/root/df5632/build_rig/df5632_rig.ko sleep 1 echo "=== create the controllable child (direct device_add_child) ===" ./dfctl failchild echo "=== make the child refuse to detach ===" sysctl hw.df5632.childbusy=1 echo "=== detach the bus: STOCK swallows the child's EBUSY (rc must be 0) ===" ./dfctl detach_bus echo "=== state witness (iicbus0 driverless, softc NULL, child attached) ===" ./dfctl stat echo "=== now use the bus like the attached child would: NULL-softc deref ===" ./dfctl reqbus echo "UNREACHABLE: guest should have panicked" |