From owner-freebsd-security@FreeBSD.ORG  Mon Feb 18 15:21:18 2008
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id B775C16A4AB
	for <freebsd-security@freebsd.org>;
	Mon, 18 Feb 2008 15:21:18 +0000 (UTC)
	(envelope-from wxs@atarininja.org)
Received: from syn.atarininja.org (syn.csh.rit.edu [129.21.60.158])
	by mx1.freebsd.org (Postfix) with ESMTP id 985FE13C4DB
	for <freebsd-security@freebsd.org>;
	Mon, 18 Feb 2008 15:21:18 +0000 (UTC)
	(envelope-from wxs@atarininja.org)
Received: by syn.atarininja.org (Postfix, from userid 1001)
	id E70665C5B; Mon, 18 Feb 2008 10:07:48 -0500 (EST)
Date: Mon, 18 Feb 2008 10:07:48 -0500
From: Wesley Shields <wxs@FreeBSD.org>
To: Mark Andrews <Mark_Andrews@isc.org>
Message-ID: <20080218150748.GD90004@atarininja.org>
References: <a9f4a3860802180527k6fcfbdaeuf235540075b263b5@mail.gmail.com>
	<200802181414.m1IEE8bd075081@drugs.dv.isc.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200802181414.m1IEE8bd075081@drugs.dv.isc.org>
User-Agent: Mutt/1.5.17 (2007-11-01)
X-Mailman-Approved-At: Mon, 18 Feb 2008 15:33:06 +0000
Cc: Dag-Erling Sm?rgrav <des@des.no>, Jim Bryant <freebsd@electron-tube.net>,
	Kurt Buff <kurt.buff@gmail.com>, freebsd-security@freebsd.org
Subject: Re: How to take down a system to the point of requiring a newfs
	with one line of C (userland)
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 18 Feb 2008 15:21:18 -0000

On Tue, Feb 19, 2008 at 01:14:08AM +1100, Mark Andrews wrote:
> 
> > Patient: Doctor, it hurts when I do this!
> > 
> > Doctor: Don't do that...
> 
> Did you actually bother to read his report?
> 
> While his example is used "/", if the report is correct then you
> just need to replace "/" with the path of any file system mount
> point that is world writable like say "/tmp".
> 
> Do you have /tmp mounted like this?
> /dev/ad0s4e    507630   162050   304970    35%    /tmp
> 
> Have you tried using "/tmp" or some other suitable mount point
> before slinging off with the old Doctor joke?
> 
> Even if it is only "/", having the system die and not be recoverable
> due to having a excessive number of files in "/" is a critical
> error.  I'm sure you have *never* accidently copied a set of files
> to "/" in your life.  Me, I know I've made that sort of mistake in
> the past, and as I'm not perfect, I'm sure I'll make that sort of
> mistake at some point in the future.  I would however like the
> machine not to fallover when I do make that mistake.
> 
> Now why don't you be constructive and verify whether the report is
> valid or not.  I don't have a spare machine to test it on so I'm
> not going to attempt it.

I tried this using /tmp/ as argv[1] and it didn't crash a 6.2 machine or
a -current from a few weeks ago.  Maybe the number of files has to be
increased?  I bumped it up to 100000 and tried on a 6.2 machine, but I
ran out of inodes before I could induce a crash.  :)

Maybe I'm doing something wrong?

-- WXS