⬢ DragonFlyBSD Kernel Audit
DF-5839 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "finding_id": "DF-5839",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh  (KLD; cc -Werror; output /usr/obj/tmp/df5839/df5839.ko)",
    "run": "kldload /usr/obj/tmp/df5839/df5839.ko && sysctl -n debug.df5839.run=1",
    "expected": "baseline: panic 'assertion \"td->td_refs > 0\" failed in lwkt_rele' at lwkt_thread.c:505 after the gd_freetd corpse is reborn (child == victim, refs wiped to 0); with fix.diff: 'lwkt_alloc_thread: freetd corpse ... dropping', fresh td, no panic"
  },
  "kernel_refs": [
    "sys/kern/lwkt_thread.c:497-507",
    "sys/kern/lwkt_thread.c:1707-1742",
    "sys/kern/lwkt_thread.c:365-380",
    "sys/kern/lwkt_thread.c:445",
    "sys/kern/lwkt_thread.c:505-506",
    "sys/kern/kern_exit.c:857-860",
    "sys/kern/kern_proc.c:1804-1818"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df5839.c", "Makefile", "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "run.patched.log",
    "panic.txt", "console-full.log", "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ],
  "code_hash": "3f0ec86539ae2ee25522c540cf0aa76accbb30e8cc3b9159945c61da173ae03b"
}