⬢ DragonFlyBSD Kernel Audit
DF-5829 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
  "finding_id": "DF-5829",
  "title": "vm_object_page_clean() partial-range clean is a silent no-op (msync(MS_SYNC) performs no writeback; on hammer2 every msync range)",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O2 -Wall -o msync_poc msync_poc.c",
    "run": "./msync_poc 3 [dir-on-hammer2-or-ufs]",
    "expected": "vulnerable kernel: partial-range and in-file-hammer2 arms show vnodeout delta = 0 while a range equal to the (block-rounded) object size flushes; patched kernel: every arm flushes"
  },
  "kernel_refs": [
    "sys/vm/vm_object.c:981",
    "sys/vm/vm_object.c:991",
    "sys/vm/vm_object.c:1039",
    "sys/vm/vm_object.c:1074",
    "sys/vm/vm_object.c:1175",
    "sys/vm/vm_map.c:3148",
    "sys/kern/vfs_vm.c:465",
    "sys/vm/vnode_pager.c:764"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "msync_poc.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "run.2.log",
    "run.h2.log",
    "run.3-ufs.log",
    "run.patched-h2.log",
    "fix.diff",
    "fix_build.log",
    "env.txt",
    "manifest.json",
    "verdict.json"
  ]
}