Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 20 Nov 2006 18:26:59 -0500
From:      Kris Kennaway <kris@obsecurity.org>
To:        David Xu <davidxu@freebsd.org>
Cc:        freebsd-current@freebsd.org, Kris Kennaway <kris@obsecurity.org>
Subject:   Re: Thread stuck in aioprn
Message-ID:  <20061120232659.GA50627@xor.obsecurity.org>
In-Reply-To: <200611210721.35740.davidxu@freebsd.org>
References:  <20061004203715.GA38692@xor.obsecurity.org> <200610061116.31469.davidxu@freebsd.org> <20061120195454.GA47063@xor.obsecurity.org> <200611210721.35740.davidxu@freebsd.org>

next in thread | previous in thread | raw e-mail | index | archive | help

--HlL+5n6rz5pIUxbD
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Tue, Nov 21, 2006 at 07:21:35AM +0800, David Xu wrote:
> On Tuesday 21 November 2006 03:54, Kris Kennaway wrote:
> > On Fri, Oct 06, 2006 at 11:16:31AM +0800, David Xu wrote:
> > > On Friday 06 October 2006 08:14, Kris Kennaway wrote:
> > > > FYI, this has recurred, so it seems to be an easy problem to trigger.
> > > >
> > > > Kris
> > >
> > > can you try attached patch ? it disables support for non-disk files,
> > > I suspect the test passed non-disk file handle to aio, and caused
> > > the problem.
> > >
> > > David Xu
> >
> > This fix seems to work.
> >
> > Kris
> OK, so there are too choices, fix aio for all I/O facilities or disable aio
> for non-disk files, this will make daily usage safe.

I'm still not convinced it's not a more basic input validation error;
AFAIK the syscall test just inputs random data so it would be very
unlikely that this would magically construct itself into a legitimate
request but for a non-disk file.

i.e. fp->f_type != DTYPE_VNODE in the request (since it's random, this
is likely to be true), but the rest of the fp is garbage and is
causing something further on to hang instead of rejecting the garbage
data.

A good test would be to call with fp->f_type == DTYPE_VNODE and the
rest garbage and see if it still hangs.

Kris

--HlL+5n6rz5pIUxbD
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (FreeBSD)

iD8DBQFFYjnDWry0BWjoQKURAm1bAJ0b4QHCPnPbO1mcfkTDWUJf6k7GfACgiKZN
1wdDFRihZ+6N0Xg894RUHcE=
=6hHd
-----END PGP SIGNATURE-----

--HlL+5n6rz5pIUxbD--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20061120232659.GA50627>