From owner-freebsd-current  Tue May 30  7:28:44 2000
Delivered-To: freebsd-current@freebsd.org
Received: from news.uni-kl.de (news.uni-kl.de [131.246.137.51])
	by hub.freebsd.org (Postfix) with SMTP id 08EFF37BD7C
	for <freebsd-current@freebsd.org>; Tue, 30 May 2000 07:28:39 -0700 (PDT)
	(envelope-from naddy@unix-ag.uni-kl.de)
Received: from sushi.unix-ag.uni-kl.de
           ( root@sushi.unix-ag.uni-kl.de [131.246.89.13] ) by news.uni-kl.de
          id aa00752 for <freebsd-current@freebsd.org>; 30 May 2000 16:28 MESZ
Received: (from naddy@localhost)
	by sushi.unix-ag.uni-kl.de (8.9.3/8.9.1) id QAA31911
	for freebsd-current@freebsd.org; Tue, 30 May 2000 16:28:31 +0200
Date: Tue, 30 May 2000 16:28:31 +0200
From: Christian Weisgerber <naddy@unix-ag.uni-kl.de>
To: freebsd-current@freebsd.org
Subject: "fetch | sh" panics system
Message-ID: <20000530162831.A27439@sushi.unix-ag.uni-kl.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0i
Sender: owner-freebsd-current@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

5.0-CURRENT from ~May 17, dual ppro.

The following, completely innocuous command line

$ fetch -o - http://sites.inka.de/mips/unix/freebsd/xterm.shar | sh

executed as a non-priviledged user, reproducibly panics the machine.

-----------------
#0  boot (howto=256) at ../../kern/kern_shutdown.c:303
#1  0xc0163879 in panic (fmt=0xc028dc4f "page fault")
    at ../../kern/kern_shutdown.c:553
#2  0xc025760c in trap_fatal (frame=0xc8830d74, eva=52)
    at ../../i386/i386/trap.c:927
#3  0xc025727d in trap_pfault (frame=0xc8830d74, usermode=0, eva=52)
    at ../../i386/i386/trap.c:820
#4  0xc0256de3 in trap (frame={tf_fs = -930938856, tf_es = -1072103408, 
      tf_ds = -1062797296, tf_edi = -930935184, tf_esi = -930935300, 
      tf_ebp = -930935340, tf_isp = -930935392, tf_ebx = -931419456, 
      tf_edx = 0, tf_ecx = 13, tf_eax = -930935360, tf_trapno = 12, 
      tf_err = 0, tf_eip = -1062106920, tf_cs = 8, tf_eflags = 66195, 
      tf_esp = -930935360, tf_ss = -930935300}) at ../../i386/i386/trap.c:426
#5  0xc0b188d8 in ?? ()
#6  0xc0198fae in vn_open (ndp=0xc8830ec8, fmode=1026, cmode=420)
    at vnode_if.h:305
#7  0xc0195005 in open (p=0xc7df7a00, uap=0xc8830f80)
    at ../../kern/vfs_syscalls.c:995
#8  0xc025793d in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 47, 
      tf_edi = 8, tf_esi = 672168216, tf_ebp = -1077938468, 
      tf_isp = -930934828, tf_ebx = 672102756, tf_edx = 672168216, 
      tf_ecx = 15, tf_eax = 5, tf_trapno = 12, tf_err = 2, tf_eip = 672019108, 
      tf_cs = 31, tf_eflags = 663, tf_esp = -1077938512, tf_ss = 47})
    at ../../i386/i386/trap.c:1126
#9  0xc024579e in Xint0x80_syscall ()

-- 
Christian "naddy" Weisgerber                     naddy@unix-ag.uni-kl.de


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-current" in the body of the message