tbodt

Problem

• Create named pipe in fakefs (turns out this creates a real named pipe!)
• Open it
• This blocks, while holding inodes_lock

Why does it hold the lock?

commit d57b6d26fad3103d2303efe0fa8d74c56a8e637b
Author: Theodore Dubois [email protected]

tbodt

AAIAAAABAEAAAgEwAAMAAQACAAcAAwACAAIABgADADAABAABAAMABwAEAAIAAwAGAAQAEgAFAAEABAAHAAUAAQAEABUAAAABAAQABwAAAAIABAAGAAEAQAACAQUAAwADAAIABQADAAMAAgAFAAMAAwACAAQAAwAEAAIABAADAAQAAgADAAMABQACAAIAAwAGAAIAAQADAAwABAADAAMABQAEAAMAAwAFAAQAAwADAAQABAAEAAMABAAEAAQAAwADAAQABQADAAIABAAGAAMAAQAEAAwAAAADAAQABQAAAAMABAAFAAAAAwAEAAQAAAAEAAQABAAAAAQABAADAAAABQAEAAIAAAAGAAQAAQAAAAcAAQBAAAIBAAADAAIAAgAGAAMAAgACAAYAAwADAAIABQADAAMAAgAFAAMAAwACAAUAAwAEAAIABAADAAUAAgADAAMABgACAAIABAACAAMABgAEAAIAAwAGAAQAAwADAAUABAADAAMABQAEAAMAAwAFAAQABAADAAQABAAFAAMAAwAEAAYAAwACAAAAAgAEAAYAAAACAAQABgAAAAMABAAFAAAAAwAEAAUAAAADAAQABQAAAAQABAAEAAAABQAEAAMAAAAGAAQAAgABAEAAAgFgAAMAAQACAAcAAwABAAIABwADAAIAAgAGAAMAAwACAAUAAwAGAAIAAQADABkABAABAAMABwAEAAEAAwAHAAQAAgADAAYABAADAAMABQABAEAAAgEvAAMAAQACABUAAwADAAIABAADAAQAAgAEAAMABAACAAMAAwAFAAIAAwADAAQABgABAAIAAwADAAQABgABAAIAAgADAAYAAgACAAMACgAEAAQAAwAEAAQABAADAAQABAAEAAMAAwAEAAUAAwADAAQABQADAAMABAAEAAAAAQADAAIABAAGAAMAAgAEAAYAAQBAAAIBAwADAAUAAgABAAMABwACAAEAAwAwAAYABwADAAEABgAHAAMAAQAGAC8ABAABAAAABwAEAAEAAAAH

tbodt

*.html: %.php
  php $< > $@
all: $(shell find . -name '*.php')

tbodt

======================================================================================
======================================================================================
== Tweedle D & Tweedle dum! ==========================================================
======================================================================================
======================================================================================
Sun, 25 Oct 2020 4:44PM PST.... ======================================================
Author: NOBODY (et-al) ===============================================================
======================================================================================
= OR 'hello world of TMM & PKA' ======================================================

tbodt

#!/usr/sbin/dtrace -Cs
#pragma D option quiet

dtrace:::BEGIN {
    printf("top outstanding allocation backtrace:\n");
    printf("%d bytes in %d sampled allocations (sampling 1 in %d)\n", `top_ztrace->zt_size, `top_ztrace->zt_hit_count, `zleak_sample_factor);
    printf("estimate: %d bytes in %d total allocations, %d bytes/allocation\n", `top_ztrace->zt_size * `zleak_sample_factor, `top_ztrace->zt_hit_count * `zleak_sample_factor, `top_ztrace->zt_size / `top_ztrace->zt_hit_count);
#define A(i) \
    if (`top_ztrace->zt_depth > i) { \
        sym((user_addr_t)`top_ztrace->zt_stack[i]); \

tbodt

tbodt

#include <pthread.h>
#define ATOMIC 1

int flags;

void *thread(void *asdf) {
    (void) asdf;
    for (;;) {
#if ATOMIC
        __atomic_fetch_or(&flags, 1 << 3, __ATOMIC_SEQ_CST);

tbodt

SEQUENCE OF EVENTS

• /file has inode 1.
• Thread A opens /file and creates the in-memory inode 1.
• Thread A closes its file handle and enters the code path to destroy the in-memory inode 1, but is preempted after releasing inode_lock and before calling inode_orphaned.
• Thread B opens /file and re-creates the in-memory inode 1.
• Thread B renames /file2, which has inode 2, to /file. This removes the last reference to inode 1 in the database.
• Thread A wakes up and goes to finish the destruction of inode 1, which removes it from the database since it has no more references.
• Thread B calls fstat on its open handle to inode 1. This fails because it's gone from the database.

tbodt

//
//  AppDelegate.m
//  ptrace test
//
//  Created by Theodore Dubois on 2/1/19.
//  Copyright © 2019 Theodore Dubois. All rights reserved.
//

#import "AppDelegate.h"
#include <sys/mman.h>

tbodt

#include <iostream>
#include <math.h>
using namespace std;
int main() {

}
#!/bin/bash
using System;
using System.Collections.Generic;
using System.Linq;