From owner-freebsd-security@FreeBSD.ORG Mon Feb 18 20:52:53 2008 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 94C2416A419 for ; Mon, 18 Feb 2008 20:52:53 +0000 (UTC) (envelope-from mike@sentex.net) Received: from smarthost1.sentex.ca (smarthost1.sentex.ca [64.7.153.18]) by mx1.freebsd.org (Postfix) with ESMTP id 5E9CC13C4D9 for ; Mon, 18 Feb 2008 20:52:53 +0000 (UTC) (envelope-from mike@sentex.net) Received: from lava.sentex.ca (pyroxene.sentex.ca [199.212.134.18]) by smarthost1.sentex.ca (8.14.2/8.14.2) with ESMTP id m1IKqlhs066139; Mon, 18 Feb 2008 15:52:47 -0500 (EST) (envelope-from mike@sentex.net) Received: from mdt-xp.sentex.net (simeon.sentex.ca [192.168.43.27]) by lava.sentex.ca (8.13.8/8.13.3) with ESMTP id m1IKqkFF004605 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 18 Feb 2008 15:52:46 -0500 (EST) (envelope-from mike@sentex.net) Message-Id: <200802182052.m1IKqkFF004605@lava.sentex.ca> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 18 Feb 2008 15:53:09 -0500 To: Jim Bryant From: Mike Tancsa In-Reply-To: <47B90868.7000900@electron-tube.net> References: <47B90868.7000900@electron-tube.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Cc: freebsd-security@freebsd.org Subject: Re: How to take down a system to the point of requiring a newfs with one line of C (userland) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Feb 2008 20:52:53 -0000 At 11:24 PM 2/17/2008, Jim Bryant wrote: >One line summary: > Too many files in a top-level UFS-2 filesystem directory will > cause a panic on mount. >How to repeat the problem: > Compile and run the following as instructed: > >umount that filesystem. Hi, I tried this on RELENG_7 and RELENG_6 and was not able to panic the box 0[releng7]# ls -l | wc 20098 200972 1377211 0[releng7]# df -i Filesystem 1K-blocks Used Avail Capacity iused ifree %iused Mounted on /dev/ad6s1a 1012974 284464 647474 31% 3308 138002 2% / devfs 1 1 0 100% 0 0 100% /dev /dev/ad6s1d 5077038 1221890 3448986 26% 20243 639211 3% /tmp /dev/ad6s1e 25385516 15683412 7671264 67% 370099 2927179 11% /usr /dev/ad6s1f 40139596 847342 36081088 2% 1001 5203989 0% /var 0[releng7]# and releng_6 0[nanobsd]# ./a.out /tmp/k 0[nanobsd]# ./a.out /tmp/kl 0[nanobsd]# ls -l /tmp/ | wc 20248 182229 1327842 0[nanobsd]# df -i Filesystem 1K-blocks Used Avail Capacity iused ifree %iused Mounted on /dev/twed0s1a 1012974 109076 822862 12% 2099 139211 1% / devfs 1 1 0 100% 0 0 100% /dev /dev/twed0s1d 4058062 3264732 468686 87% 23045 518649 4% /tmp /dev/twed0s1f 82042376 57488474 17990512 76% 2014718 8607232 19% /usr /dev/twed0s1e 20308398 5173252 13510476 28% 1813 2636009 0% /var 0[nanobsd]# After running the program and creating all the files, I just did a reboot and all worked just fine post reboot. Did you fill up the partition or run out of inodes perhaps ? ---Mike