Bugtraq: tmpfs panic fix - was Re: udp packet storms - ping death

[8lgm () bagpuss demon co uk ([8LGM] Security Team)]

David A. Wagner wrote:
> ObBug: if you use the SunOS tmpfs, try
>
> cd /tmp; /usr/etc/mknod fifo p; ln fifo link; ls -ClFg link fifo
>
> ...but not at peak hours!
>
> Sun knows about it and after a year, there's still no fix.  [As
> far as I know -- if there's one, I'd love to hear of it, so I can
> tell the computer center here to add the darn thing: after hearing
> of this one, they hacked the kernel and removed the mkfifo and
> mknod S_IFIFO system calls. <sigh>]
Here is our workaround for this.  The problem is that for a special file,
tmp_link() tries to update the link count (va_nlink in vattr) in the snode's
vnode, rather than the real vnode.

We take no responsibility for this code; it was developed without any source.
Read it through and then use it if you like it.  It works for us on SunOS 4.1.1
on a Sun3.  Not tested on anything else.

If you do use it, we'd be interested to hear whether or not it works for you.
Please mail 8lgm () bagpuss demon co uk 

To use this, create the following program - 8lgm_tmpfs.c.  Then compile and
load using the commands described in the header comment.

8<------------------------- cut here -------------------------

/*
 * 8lgm_tmpfs.c -  SunOS 4.1.x TMPFS bugfix.
 * Copyright (C) 1994 by [8LGM].
 *
 * This works around a fatal bug in tmpfs, reported to Bugtraq
 * by dawagner () phoenix princeton edu (David A. Wagner) on 2/11/94.
 *
 * Bug:
 *      cd /tmp; /usr/etc/mknod fifo p; ln fifo link; ls -ClFg link fifo
 *      panics the kernel with a bus error.
 *
 * To use:
 *      cc -c -O -DKERNEL -D<kernel-arch> 8lgm_tmpfs.c
 *      modload 8lgm_tmpfs.o
 */

#include <sys/types.h>
#include <sys/conf.h>
#include <sys/buf.h>
#include <sys/param.h>
#include <sys/errno.h>
#include <sys/user.h>
#include <sys/time.h>
#include <sys/vfs.h>
#include <sys/vnode.h>
#include <sys/ucred.h>
#include <sys/syslog.h>
#include <sundev/mbvar.h>
#include <sun/autoconf.h>
#include <sun/vddrv.h>

extern  struct vnodeops tmp_vnodeops;
struct  vdldrv vd;

int     (*real_tmp_link)();
int     loaded_8lgm = 0;

int
tmp_link_8lgm(vn, dirp, name, cred)
        struct vnode *vn;
        struct vnode *dirp;
        char *name;
        struct ucred*cred;
{
        struct vnode *real_vn;
        
        if (!(VOP_REALVP(vn, &real_vn)))
                vn = real_vn;
        return ((real_tmp_link)(vn, dirp, name, cred));
}


int
load_8lgm_tmpfsfix()
{
        int     x;

        x = splhigh();
        real_tmp_link = tmp_vnodeops.vn_link;
        tmp_vnodeops.vn_link = tmp_link_8lgm;
        splx(x);
        return(0);
}


int
unload_8lgm_tmpfsfix()
{
        int     x;

        x = splhigh();
        tmp_vnodeops.vn_link = real_tmp_link;
        splx(x);
        return(0);
}


int
xxxinit(function_code, vdp, vdi, vds)
        unsigned int function_code;
        struct vddrv *vdp;
        addr_t vdi;
        struct vdstat *vds;
{
        bzero(&vd, sizeof(vd));
        vd.Drv_magic = VDMAGIC_PSEUDO;
        vd.Drv_name = "8lgm-tmpfs";

        switch(function_code) {
                case VDLOAD:
                        if (loaded_8lgm) {
                                log(LOG_INFO, "8lgm: tmpfs fix module loaded\n");
                                return(EEXIST);
                        }
                        vdp->vdd_vdtab = (struct vdlinkage*)&vd;
                        load_8lgm_tmpfsfix();
                        loaded_8lgm++;
                        log(LOG_INFO, "8lgm: tmpfs fix module loaded\n");
                        return(0);
                case VDUNLOAD:
                        return (unload(vdp, vdi));
                case VDSTAT:
                        return(0);
                default:
                        return(EIO);
        }
}


static int
unload(vdp, vdi)
        struct vddrv *vdp;
        struct vdioctl_unload *vdi;
{
        if (loaded_8lgm == 0) {
                log(LOG_INFO, "8lgm: tmpfs fix module not loaded!\n");
                return(0);
        }
        unload_8lgm_tmpfsfix();
        loaded_8lgm = 0;
        log(LOG_INFO, "8lgm: tmpfs fix module unloaded\n");
        return(0);
}

8<------------------------- cut here -------------------------

-----------------------------------------------------------------------
$ echo help | mail 8lgm-fileserver () bagpuss demon co uk  (Fileserver help)
8lgm-bugs () bagpuss demon co uk           (To report security flaws)
8lgm-request () bagpuss demon co uk        (Request to be added to list)
8lgm () bagpuss demon co uk                (General enquiries)