DF-5683 / vq_leak.sh
#!/bin/sh # DF-5683 — unprivileged per-call kernel heap leak in sys_vquotactl(). # Must run as an UNPRIVILEGED user (uid != 0) on vfs.quota_enabled=1 kernel. # Usage: vq_leak.sh <iterations> (default 2000) set -e ITER=${1:-2000} MOUNT=${2:-/} propstat() { vmstat -m | awk 'tolower($1) ~ /^prop/ {print}' | sort; } echo "== env =="; id; sysctl vfs.quota_enabled; uname -a echo "== prop malloc types BEFORE ==" propstat | tee /tmp/vq_before.txt echo "== running $ITER x vquota show $MOUNT (as $(id -un)) ==" i=0 while [ $i -lt $ITER ]; do out=$(vquota show "$MOUNT" 2>&1) case "$out" in total:*) ;; *) echo "unexpected vquota output at $i: $out"; exit 1;; esac i=$((i+1)) done echo "== prop malloc types AFTER $ITER calls ==" propstat | tee /tmp/vq_after.txt echo "== delta (before -> after) ==" join /tmp/vq_before.txt /tmp/vq_after.txt | awk '{printf "%-20s InUse %s -> %s\n", $1, $2, $NF==""?$2:$6}' |