From owner-freebsd-hackers@FreeBSD.ORG  Wed Apr  7 21:52:59 2010
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 3AC77106566B
	for <freebsd-hackers@freebsd.org>; Wed,  7 Apr 2010 21:52:59 +0000 (UTC)
	(envelope-from aurelien@aurel32.net)
Received: from hall.aurel32.net (unknown
	[IPv6:2a01:e0b:1:82:21c:c0ff:fe56:7beb])
	by mx1.freebsd.org (Postfix) with ESMTP id C595F8FC08
	for <freebsd-hackers@freebsd.org>; Wed,  7 Apr 2010 21:52:58 +0000 (UTC)
Received: from aurel32 by hall.aurel32.net with local (Exim 4.69)
	(envelope-from <aurelien@aurel32.net>)
	id 1NzdBA-0006BG-GX; Wed, 07 Apr 2010 23:52:56 +0200
Date: Wed, 7 Apr 2010 23:52:56 +0200
From: Aurelien Jarno <aurelien@aurel32.net>
To: Petr Salinger <Petr.Salinger@seznam.cz>
Message-ID: <20100407215256.GA2739@hall.aurel32.net>
References: <20100406092429.GV2415@deviant.kiev.zoral.com.ua>
	<Pine.LNX.4.62.1004061700590.25851@sci.felk.cvut.cz>
	<20100406140308.GY2415@deviant.kiev.zoral.com.ua>
	<20100406140852.GZ2415@deviant.kiev.zoral.com.ua>
	<20100406144402.GB2415@deviant.kiev.zoral.com.ua>
	<Pine.LNX.4.62.1004062154060.26438@sci.felk.cvut.cz>
	<20100406210321.GE2415@deviant.kiev.zoral.com.ua>
	<Pine.LNX.4.62.1004070838050.27621@sci.felk.cvut.cz>
	<20100407095928.GG2415@deviant.kiev.zoral.com.ua>
	<Pine.LNX.4.62.1004072256540.29016@sci.felk.cvut.cz>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-15
Content-Disposition: inline
In-Reply-To: <Pine.LNX.4.62.1004072256540.29016@sci.felk.cvut.cz>
X-Mailer: Mutt 1.5.18 (2008-05-17)
User-Agent: Mutt/1.5.18 (2008-05-17)
Sender: Aurelien Jarno <aurelien@aurel32.net>
X-Mailman-Approved-At: Thu, 08 Apr 2010 05:24:01 +0000
Cc: Kostik Belousov <kostikbel@gmail.com>, freebsd-hackers@freebsd.org
Subject: Re: leak of the vnodes
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 07 Apr 2010 21:52:59 -0000

On Wed, Apr 07, 2010 at 11:05:28PM +0200, Petr Salinger wrote:
>>> What have to be logged ?
>> Please look at ddb command "show files", implemented in kern/kern_descrip.c,
>> lines 3284-3305 on HEAD. Instead of doing full dump, you can manually
>> inspect the output. Or, you can write some code that would search the
>> suspicious vnodes among the vnodes referenced from the processes
>> opened files. Vnode is probably leaked if use count is > 0 but no
>> process has vnode referenced by struct file.
>
> See attached file.
>
>>>> I think there should be something else going on.
>
> Bellow is leaking recipe tested under GNU/kFreeBSD.
> I would expect it leaks vnodes also under plain FreeBSD.
>

I confirm it is reproducible on plain FreeBSD. Looks like a security
issue, as a normal user can create a local DoS in a few dozen of
seconds.

-- 
Aurelien Jarno	                        GPG: 1024D/F1BCDB73
aurelien@aurel32.net                 http://www.aurel32.net