⬢ DragonFlyBSD Kernel Audit
DF-5812 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
  "finding_id": "DF-5812",
  "title": "swaponvp() rounds swap device size UP to the stripe boundary, publishing up to 63 pages of non-existent 'phantom' swap; OOB swap I/O past device EOF and unkillable pageout retry livelock under swap pressure",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O2 -o /root/churn /root/churn.c",
    "run": "sh /root/run.sh   (200-page vn0 swap file + swapon + 4600MB anon churn)",
    "expected_unpatched": "vm.swap_size +192 pages on swapon; swapinfo claims 2048 512-blocks (1MB) for an 800KB file; during churn the console enters an infinite 'swap_pager: I/O error - pageout failed; offset 3444736 ... error 22' loop (interleave page 841 -> vn0 device page 201, first phantom page) and the guest wedges",
    "expected_patched": "vm.swap_size +128 pages; swapinfo 1536 512-blocks; churn completes; file size unchanged; swapoff succeeds"
  },
  "kernel_refs": [
    "sys/vm/vm_swap.c:365",
    "sys/vm/vm_swap.c:367",
    "sys/vm/vm_swap.c:377",
    "sys/vm/vm_swap.c:128",
    "sys/vm/swap_pager.c:537",
    "sys/vm/swap_pager.c:583",
    "sys/vm/swap_pager.c:1965"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "churn.c", "run.sh", "build.sh",
    "build.log", "run.log", "fix_run.log", "fix_build.log",
    "hang-serial-console.txt", "env.txt", "fix.diff",
    "kernel_build_first_attempt.log", "manifest.json", "verdict.json"
  ]
}