From owner-freebsd-bugs@FreeBSD.ORG Sun Oct 29 14:10:23 2006 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 68C5F16A416 for ; Sun, 29 Oct 2006 14:10:23 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2C2C343D45 for ; Sun, 29 Oct 2006 14:10:22 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k9TEALIZ072122 for ; Sun, 29 Oct 2006 14:10:21 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k9TEALdf072118; Sun, 29 Oct 2006 14:10:21 GMT (envelope-from gnats) Resent-Date: Sun, 29 Oct 2006 14:10:21 GMT Resent-Message-Id: <200610291410.k9TEALdf072118@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, trasz Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7452B16A40F for ; Sun, 29 Oct 2006 14:04:57 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 08C3043D70 for ; Sun, 29 Oct 2006 14:04:53 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id k9TE4qPH086180 for ; Sun, 29 Oct 2006 14:04:52 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id k9TE4qqO086173; Sun, 29 Oct 2006 14:04:52 GMT (envelope-from nobody) Message-Id: <200610291404.k9TE4qqO086173@www.freebsd.org> Date: Sun, 29 Oct 2006 14:04:52 GMT From: trasz To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.0 Cc: Subject: kern/104907: Filling up the disk using mmap(2) causes livelock. X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Oct 2006 14:10:23 -0000 >Number: 104907 >Category: kern >Synopsis: Filling up the disk using mmap(2) causes livelock. >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Oct 29 14:10:21 GMT 2006 >Closed-Date: >Last-Modified: >Originator: trasz >Release: 6.2-PRERELEASE >Organization: >Environment: FreeBSD traszkan.ds7 6.2-PRERELEASE FreeBSD 6.2-PRERELEASE #0: Sun Oct 29 00:57:44 CEST 2006 trasz@traszkan.ds7:/usr/obj/usr/src/sys/TRASHCAN i386 >Description: Filling up a disk using mmap(2) causes some kind of livelock. The system becomes unresponsive. These messages appear on the console: Oct 29 14:54:16 sonne kernel: pid 7 (pagedaemon), uid 0 inumber 131261 on /: filesystem full vnode_pager_putpages: I/O error 28 vnode_pager_putpages: residual I/O 131072 at 44656 vnode_pager_putpages: I/O error 28 vnode_pager_putpages: residual I/O 131072 at 45689 vnode_pager_putpages: I/O error 28 vnode_pager_putpages: residual I/O 131072 at 45391 etc. It's easy to reproduce by unpriviledged user, so it's kind of DoS bug. >How-To-Repeat: Make sure you have _not_ enough disk space and run the following program: #include #include #include #include #include /* * if there is not enough space in the filesystem, this will crash freebsd. */ int main(void) { int fd; int ret; char *addr; size_t len=1000000000L; char *path="big_file"; int i; fd=open(path, O_RDWR | O_CREAT | O_EXCL, 0664); if (fd<0) { perror("open"); exit(-1); } ret=ftruncate(fd, len); if (ret!=0) { perror("ftruncate"); unlink(path); exit(-1); } addr=mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); if (addr==MAP_FAILED) { perror("mmap"); unlink(path); exit(-1); } for (i=0; iFix: >Release-Note: >Audit-Trail: >Unformatted: