From owner-freebsd-security  Fri May 17 20:37:02 1996
Return-Path: owner-security
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id UAA18914
          for security-outgoing; Fri, 17 May 1996 20:37:02 -0700 (PDT)
Received: from godzilla.zeta.org.au (godzilla.zeta.org.au [203.2.228.19])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id UAA18900
          for <freebsd-security@FreeBSD.ORG>; Fri, 17 May 1996 20:36:54 -0700 (PDT)
Received: (from bde@localhost) by godzilla.zeta.org.au (8.6.12/8.6.9) id NAA18119; Sat, 18 May 1996 13:32:10 +1000
Date: Sat, 18 May 1996 13:32:10 +1000
From: Bruce Evans <bde@zeta.org.au>
Message-Id: <199605180332.NAA18119@godzilla.zeta.org.au>
To: coredump@nervosa.com, kato@eclogite.eps.nagoya-u.ac.jp
Subject: Re: BoS: SECURITY BUG in FreeBSD (fwd)
Cc: freebsd-security@FreeBSD.ORG
Sender: owner-security@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

>> mount_union ~/a ~/b
>> mount_union -b ~/a ~/b

>My FreeBSD-current (I supped sources on May 17.) box crashed just
>after `mount_union -b ~/a ~/b' operation.  Stack trace shows:

>_ufs_ihashget: recursive lock not expected -- pid 188 <--- mount_union

That's another problem with mount_union :-(.

Somehow it hasn't crashed here yet after I ran the above and `mount_union
~/c ~/d' to test this and wasn't able to unmount them.  Now I remember
how to unmount them: run `mount' to see what is mounted and then unmount
the name in the device column: `umount "<above/home/bde/c>"'.

Another problem with mount_union is that getdirentries() doesn't work for
the lkm version.  I have the union file system statically configured to
test it.  This may have helped avoid the above panic.  It normally hangs
instead of panicing.

Bruce