DF-5643 / run_c.sh
#!/bin/sh # DF-5643 RUN C (baseline, stock kernel): parked SMB_WAIT requester is # never woken by detach and keeps sleeping on the FREED softc. # # EXPECTED (buggy): GRAB sets owner; PARK's kthread parks in # tsleep(sc) (smbconf.c:93); VETO detaches (0) + frees the softc with # the waiter still inside smbus_request_bus; the waiter stays parked on # freed memory (done=0 forever); WAKUAF wakes it INTO the freed softc -- # the waiter re-reads freed memory and re-parks (post-free use). set -e cd /root/df5642 kldload /root/df5642/df5642_rig.ko sleep 1 # smb driver compiled into guest kernel sleep 1 echo "=== GRAB (owner = fakesmbb0) ===" ./df5642ctl grab echo "=== PARK (kthread parks in smbus_request_bus) ===" ./df5642ctl park echo "=== VETO (detach while owned; softc freed under the parked waiter) ===" ./df5642ctl veto sleep 3 echo "=== 3s later: waiter state (kernel thread df5642_park) ===" ps -ax -o pid,tdaddr,stat,wchan,comm 2>/dev/null | grep -E 'df5642|PID' || true echo "=== WAKUAF (wakeup the freed softc) ===" ./df5642ctl wakuaf sleep 1 echo "=== waiter after wakeup ===" ps -ax -o pid,tdaddr,stat,wchan,comm 2>/dev/null | grep -E 'df5642|PID' || true echo "RUN-C-DONE" |