From owner-freebsd-security@FreeBSD.ORG Mon Feb 18 18:22:24 2008 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 2B74F16A420 for ; Mon, 18 Feb 2008 18:22:24 +0000 (UTC) (envelope-from volker@vwsoft.com) Received: from frontmail.ipactive.de (frontmail.maindns.de [85.214.95.103]) by mx1.freebsd.org (Postfix) with ESMTP id DD36413C465 for ; Mon, 18 Feb 2008 18:22:23 +0000 (UTC) (envelope-from volker@vwsoft.com) Received: from mail.vtec.ipme.de (Q7d02.q.ppp-pool.de [89.53.125.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by frontmail.ipactive.de (Postfix) with ESMTP id 26BC1128844; Mon, 18 Feb 2008 19:22:14 +0100 (CET) Received: from cesar.sz.vwsoft.com (cesar.sz.vwsoft.com [192.168.16.3]) by mail.vtec.ipme.de (Postfix) with ESMTP id 28EA43F43C; Mon, 18 Feb 2008 19:20:19 +0100 (CET) Message-ID: <47B9CCC3.9060203@vwsoft.com> Date: Mon, 18 Feb 2008 19:21:55 +0100 From: Volker User-Agent: Thunderbird 2.0.0.9 (X11/20080125) MIME-Version: 1.0 To: Wesley Shields References: <200802181414.m1IEE8bd075081@drugs.dv.isc.org> <20080218150748.GD90004@atarininja.org> <268BFF3D-3853-40D5-9D69-6FC876E07ABB@gmail.com> <20080218180441.GE14660@atarininja.org> In-Reply-To: <20080218180441.GE14660@atarininja.org> X-Enigmail-Version: 0.95.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit MailScanner-NULL-Check: 1203963628.75731@F0OzFYv+CfOs+ngc1EDGgQ X-VWSoft-MailScanner: Found to be clean X-MailScanner-From: volker@vwsoft.com X-ipactive-MailScanner-Information: Please contact the ISP for more information X-ipactive-MailScanner: Found to be clean X-ipactive-MailScanner-From: volker@vwsoft.com Cc: Peter Sanchez , freebsd-security@freebsd.org Subject: Re: How to take down a system to the point of requiring a newfs with one line of C (userland) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Feb 2008 18:22:24 -0000 On 02/18/08 19:04, Wesley Shields wrote: > On Mon, Feb 18, 2008 at 09:25:29AM -0800, Peter Sanchez wrote: >> On Feb 18, 2008, at 7:07 AM, Wesley Shields wrote: >>> I tried this using /tmp/ as argv[1] and it didn't crash a 6.2 machine or >>> a -current from a few weeks ago. Maybe the number of files has to be >>> increased? I bumped it up to 100000 and tried on a 6.2 machine, but I >>> ran out of inodes before I could induce a crash. :) >>> >>> Maybe I'm doing something wrong? >> I believe the panic doesn't occur until boot. Did you reboot the box after >> writing the files to /tmp? >> >> Peter > > I did on a 6.2 machine with 10000 files in /tmp. I can reboot the > -current machine later tonight if you think it will make a difference. According to the problem report, it should panic while mounting the fs. umount and re-mount /tmp and see, if you can make it panic (a reboot shouldn't be necessary here). If you're able to do so, please send in a complete panic message and backtrace - if possible, please!