⬢ DragonFlyBSD Kernel Audit
DF-5815 / control_vs_attack.txt
← back to finding ↓ download raw
DF-5815 control vs attack (identical unprivileged hog: 3400MB anon, 60s, uid 1001)
==============================================================================

CONTROL  vm.max_launder=4076 (stock)
  swap pager pageouts : 205 -> 39047           (laundering works)
  hog                 : "hog done (61s)"       (completed)
  ssh                 : alive for the whole run + afterwards
  console             : zero "Continuous paging" lines
  recovery            : fre rebounds, counters advance

ATTACK   vm.max_launder=-32 (root sysctl write)
  run #1:
  swap pager pageouts : frozen at 205           (NOTHING laundered)
  daemon counters     : frozen (no wakeups/examined/freed deltas under
                        pressure; at exhaustion: pass grows forever)
  console             : "pagedaemon: WARNING! Continuous paging for 1
                        minutes" x5 (one per minute, indefinite)
  ssh                 : "Connection timed out during banner exchange"
                        6+ minutes; vm.sh status => down; only a hard
                        reset recovers (panic_wedge_console.txt)
  run #2 (deliberate): sysctl -32 at 03:38:48, hog 03:38:49; ssh dead and
                        3x warning by ~03:41 (attack2_console.txt)

MATH (vm_pageout.c:828-836, vm_max_launder = -32, PQ_L2_SIZE = 64):
  max_launder = -32/64 = 0 ; (0 + 9)/10 = 0 ; floor -> 1
  cap test: 1 >= -32/16 = -2  -> TRUE
  max_launder = -2 + 1 = -1   -> per-queue budget NEGATIVE
  => vm_pageout_page() laundering branch (:1171, '*max_launderp > 0')
     can never be entered; dirty pages are never cleaned by the daemon.