search for: vfs_syscal

...user writes. Results of this include the ability to execute commands as the user, and stealing the user's password (and anything else the users writes over the connection, including passwords for other machines). IV. Workaround None. V. Solution FreeBSD-current Index: kern/vfs_syscalls.c =================================================================== RCS file: /home/imp/FreeBSD/CVS/src/sys/kern/vfs_syscalls.c,v retrieving revision 1.125 retrieving revision 1.128 diff -u -r1.125 -r1.128 --- vfs_syscalls.c 1999/07/29 17:02:56 1....

...t create fifos and sockets, as expected from rsync Probably this is supported in some other operating system >How-To-Repeat: Copy a fifo and a socket with rsync Example: mkfifo /tmp/fifo rsync -avP /var/run/log /tmp/fifo /tmp/output/ >Fix: Suggested patches to kernel: --- sys/kern/vfs_syscalls.c.orig Sun Nov 30 00:59:29 2003 +++ sys/kern/vfs_syscalls.c Sun Nov 30 01:25:35 2003 @@ -1189,6 +1189,10 @@ case S_IFBLK: error = suser(p); break; + case S_IFIFO: + case S_IFSOCK: + error = 0; + break; default: error = suser_xxx(0, p, PRISON_ROOT); break; @@ -1217,6 +1221,12 @@...

...io_awrite (bp=0xccc3e848) at vnode_if.h:1193 #16 0xb71f1bd7 in ffs_fsync (ap=0xf8237cf4) at /usr/src/sys/ufs/ffs/ffs_vnops.c:220 #17 0xb71f051e in ffs_sync (mp=0xc05d2e00, waitfor=2, cred=0xbd042a00, p=0xb72ab3c0) at vnode_if.h:558 #18 0xb717f647 in sync (p=0xb72ab3c0, uap=0x0) at /usr/src/sys/kern/vfs_syscalls.c:577 #19 0xb714e28e in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:235 #20 0xb714e965 in panic (fmt=0xb72635e0 "kmem_malloc(%ld): kmem_map too small: %ld total allocated") at /usr/src/sys/kern/kern_shutdown.c:595 #21 0xb71fccd7 in kmem_malloc (map=0xb729d100, size=4096, flags...

...c2dec4) at /usr/src/sys/kern/vfs_lookup.c:301 #8 0x80173824 in namei (ndp=0xbfc2dec4) at /usr/src/sys/kern/vfs_lookup.c:153 #9 0x8017c867 in vn_open (ndp=0xbfc2dec4, fmode=1, cmode=420) at /usr/src/sys/kern/vfs_vnops.c:138 #10 0x8017899c in open (p=0xbf57b000, uap=0xbfc2df80) at /usr/src/sys/kern/vfs_syscalls.c:1029 #11 0x8023c485 in syscall2 (frame={tf_fs = 47, tf_es = 134610991, tf_ds = 2143223855, tf_edi = 4, tf_esi = 672253248, tf_ebp = 2143284976, tf_isp = -1077747756, tf_ebx = 672178060, tf_edx = 672253248, tf_ecx = 16, tf_eax = 5, tf_trapno = 12, tf_err = 2, tf_eip = 672086720, tf_cs = 31...

Hello, I'm experiencing a kernel panic that appears to be caused by zfs. No errors are making it into /var/log/messages, but here is the error message that appears on my screen after panic (transcribed): panic solaris assert BSWAP_32(sa_hdr_phys->sa_magic) == SA_MAGIC, file: /src/sys/modules/zfs/../../cddl/contrib/opensolaris/uts/common/fs/zfs/sa.c, line 1262 I can reproduce this by

...flush (mp=0xc23a7400, rootrefs=1, flags=2) at /usr/src/sys/kern/vfs_subr.c:1786 #17 0xc02c7b60 in nfs_unmount (mp=0xc23a7400, mntflags=524288, p=0xe8177520) at /usr/src/sys/nfs/nfs_vfsops.c:1010 #18 0xc025079a in dounmount (mp=0xc23a7400, flags=524288, p=0xe8177520) at /usr/src/sys/kern/vfs_syscalls.c:516 #19 0xc0250692 in unmount (p=0xe8177520, uap=0xe84b7f80) at /usr/src/sys/kern/vfs_syscalls.c:470 #20 0xc039abf9 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 134669512, tf_esi = 134751552, tf_ebp = -1077937216, tf_isp = -397705260, tf_ebx = 1, tf_edx = 134...

...Sep 26 02:01:27 leader kernel: --- syscall (5, FreeBSD ELF64, sys_open), rip = 0x80185baca, rsp = 0x7fffffffd168, rbp = 0x7fffffffd1a0 --- messages.0:Sep 23 10:08:11 leader kernel: lock order reversal: messages.0-Sep 23 10:08:11 leader kernel: 1st 0xfffff801ba2e65f0 ufs (ufs) @ /usr/src/sys/kern/vfs_syscalls.c:3435 messages.0-Sep 23 10:08:11 leader kernel: 2nd 0xfffffe01ef93c1c0 bufwait (bufwait) @ /usr/src/sys/ufs/ffs/ffs_vnops.c:262 messages.0-Sep 23 10:08:11 leader kernel: 3rd 0xfffff801ba2e6240 ufs (ufs) @ /usr/src/sys/kern/vfs_subr.c:2099 messages.0-Sep 23 10:08:11 leader kernel: KDB: stack ba...

...r) return (error); --- 119,126 ---- } } else { ndp->ni_cnd.cn_nameiop = LOOKUP; ! ndp->ni_cnd.cn_flags = ! ((fmode & O_NOFOLLOW) ? NOFOLLOW : FOLLOW) | LOCKLEAF; error = namei(ndp); if (error) return (error); *** kern/LINK/vfs_syscalls.c Wed Aug 4 12:44:30 1999 --- kern/vfs_syscalls.c Sat Aug 28 10:48:51 1999 *************** *** 694,699 **** --- 694,701 ---- flags = FFLAGS(uap->flags); if ((flags & FREAD + FWRITE) == 0) return (EINVAL); + if (flags & O_NOFOLLOW) + flags &am...

...0f5 in ufs_vnoperate (ap=0xcf466e10) at /usr/src/sys/ufs/ufs/ufs_vnops.c:2376 #14 0xc01976ad in lookup (ndp=0xcf466e8c) at vnode_if.h:52 #15 0xc0197198 in namei (ndp=0xcf466e8c) at /usr/src/sys/kern/vfs_lookup.c:153 #16 0xc019d009 in lstat (p=0xced0fd40, uap=0xcf466f80) at /usr/src/sys/kern/vfs_syscalls.c:1823 #17 0xc0241229 in syscall2 (frame={tf_fs = -1078001617, tf_es = -817496017, tf_ds = 672071727, tf_edi = 134617856, tf_esi = 134617936, tf_ebp = -1077937420, tf_isp = -817467436, tf_ebx = 672079852, tf_edx = 134557696, tf_ecx = 0, tf_eax = 190, tf_trapno = 0, tf_err = 2...

...=0xfffffffebe6f396c, cmode=Variable "cmode" is not available. ) at vnode_if.h:199 #13 0xffffffff8051ce23 in kern_open (td=0xffffff0001c476e0, path=0x7fffffffe850 <Address 0x7fffffffe850 out of bounds>, pathseg=Variable "pathseg" is not available. ) at /usr/src/sys/kern/vfs_syscalls.c:1042 #14 0xffffffff8075ed1c in syscall (frame=0xfffffffebe6f3c80) at /usr/src/sys/amd64/amd64/trap.c:907 #15 0xffffffff807449bb in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:330 #16 0x00000008019c8ffc in ?? () Previous frame inner to this frame (corrupt stack?)

.../usr/src/sys/ufs/ffs/ffs_softdep.c:4024 #8 0xc033a596 in ffs_fsync (ap=0xc0431c78) at /usr/src/sys/ufs/ffs/ffs_vnops.c:134 #9 0xc033921f in ffs_sync (mp=0xc22de600, waitfor=2, cred=0xc1452900, p=0xc04aea40) at vnode_if.h:558 #10 0xc025a30f in sync (p=0xc04aea40, uap=0x0) at /usr/src/sys/kern/vfs_syscalls.c:577 #11 0xc02297aa in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:235 #12 0xc0229e4d in panic (fmt=0xc042876c "%s") at /usr/src/sys/kern/kern_shutdown.c:595 #13 0xc03a196b in trap_fatal (frame=0xc0431d90, eva=1541208578) at /usr/src/sys/i386/i386/trap.c:974 #14 0xc03a161...

...p=0xc841c640) at ../../ufs/ffs/ffs_softdep.c:4048 #20 0xc01d5d12 in ffs_fsync (ap=0xc82c7bfc) at ../../ufs/ffs/ffs_vnops.c:134 #21 0xc01d49a3 in ffs_sync (mp=0xc0b9ae00, waitfor=2, cred=0xc0731900, p=0xc02b94e0) at vnode_if.h:558 #22 0xc018b0df in sync (p=0xc02b94e0, uap=0x0) at ../../kern/vfs_syscalls.c:576 #23 0xc015b08a in boot (howto=256) at ../../kern/kern_shutdown.c:235 #24 0xc015b714 in poweroff_wait (junk=0xc02594cc, howto=-1071280145) at ../../kern/kern_shutdown.c:595 #25 0xc021c30a in trap_fatal (frame=0xc82c7d1c, eva=44) at ../../i386/i386/trap.c:974 #26 0xc021bfdd in trap_pf...

...a95ec4) at /usr/src/sys/kern/vfs_lookup.c:301 #8 0x80173824 in namei (ndp=0xc2a95ec4) at /usr/src/sys/kern/vfs_lookup.c:153 #9 0x8017c867 in vn_open (ndp=0xc2a95ec4, fmode=1, cmode=420) at /usr/src/sys/kern/vfs_vnops.c:138 #10 0x8017899c in open (p=0xc26fa9c0, uap=0xc2a95f80) at /usr/src/sys/kern/vfs_syscalls.c:1029 #11 0x8023c485 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 2143223855, tf_edi = 4, tf_esi = 672253248, tf_ebp = 2143284976, tf_isp = -1029087276, tf_ebx = 672178060, tf_edx = 672253248, tf_ecx = 16, tf_eax = 5, tf_trapno = 12, tf_err = 2, tf_eip = 672086720, tf_cs = 31, tf_ef...

...attr (ap=0xd7508dfc) at ../../ufs/ufs/ufs_vnops.c:509 #16 0xc02734dd in ufs_vnoperate (ap=0xd7508dfc) at ../../ufs/ufs/ufs_vnops.c:2376 #17 0xc01acaba in vn_open (ndp=0xd7508ec8, fmode=1026, cmode=420) at vnode_if.h:305 #18 0xc01a8a2c in open (p=0xd7409220, uap=0xd7508f80) at ../../kern/vfs_syscalls.c:1029 #19 0xc02bcfc5 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = -1077938272, tf_esi = -1077938292, tf_ebp = -1077938272, tf_isp = -682586156, tf_ebx = 134953192, tf_edx = 1537, tf_ecx = 0, tf_eax = 5, tf_trapno = 12, tf_err = 2, tf_eip = 134734140, tf_cs =...

...in lookup (ndp=0xdf65dec8) at vnode_if.h:52 #12 0xc01ceb80 in namei (ndp=0xdf65dec8) at /usr/src/sys/kern/vfs_lookup.c:153 #13 0xc01d73be in vn_open (ndp=0xdf65dec8, fmode=1538, cmode=420) at /usr/src/sys/kern/vfs_vnops.c:99 #14 0xc01d3688 in open (p=0xd865dc20, uap=0xdf65df80) at /usr/src/sys/kern/vfs_syscalls.c:1029 #15 0xc02c12b5 in syscall2 (frame={tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 8, tf_esi = 672455168, tf_ebp = -1077937200, tf_isp = -546971692, tf_ebx = 672379980, tf_edx = 672455168, tf_ecx = 16, tf_eax = 5, tf_trapno = 22, tf_err = 2, tf_eip = 672287832, tf_cs = 31, tf_ef...

...ookup (ndp=0xd8d2eec8) at vnode_if.h:52 #9 0xc024b4f4 in namei (ndp=0xd8d2eec8) at /usr/src/sys/kern/vfs_lookup.c:153 #10 0xc0253f3f in vn_open (ndp=0xd8d2eec8, fmode=1, cmode=0) at /usr/src/sys/kern/vfs_vnops.c:138 #11 0xc0250074 in open (p=0xd8b87f20, uap=0xd8d2ef80) at /usr/src/sys/kern/vfs_syscalls.c:1029 #12 0xc03c25b5 in syscall2 (frame={tf_fs = 134676527, tf_es = 47, ---Type <return> to continue, or q <return> to quit--- tf_ds = -1078001617, tf_edi = 4, tf_esi = 686954328, tf_ebp = -1077941708, tf_isp = -657264684, tf_ebx = 686871084, tf_edx = 0, tf_ecx = 15...

.../vm/vm_object.c:806 #11 0xc01f9f91 in vm_object_page_clean (object=0xcf824600, start=0, end=0, flags=4) at /usr/src/sys/vm/vm_object.c:605 #12 0xc01a11f5 in vfs_msync (mp=0xc6016200, flags=2) at /usr/src/sys/kern/vfs_subr.c:2710 #13 0xc01a2194 in sync (p=0xc02b73a0, uap=0x0) at /usr/src/sys/kern/vfs_syscalls.c:575 #14 0xc0171c2a in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:235 #15 0xc01722b4 in poweroff_wait (junk=0xc0272a6c, howto=-1071176283) at /usr/src/sys/kern/kern_shutdown.c:595 #16 0xc023dd1e in trap_fatal (frame=0xcf7d9e64, eva=0) at /usr/src/sys/i386/i386/trap.c:974 #17 0xc023d...

...awrite (bp=0xcf9ac218) at vnode_if.h:1193 #20 0xc022e50b in ffs_fsync (ap=0xe026cc9c) at /usr/src/sys/ufs/ffs/ffs_vnops.c:220 #21 0xc022cdea in ffs_sync (mp=0xc325fa00, waitfor=2, cred=0xc1c5b900, p=0xc02f2200) at vnode_if.h:558 #22 0xc018b37b in sync (p=0xc02f2200, uap=0x0) at /usr/src/sys/kern/vfs_syscalls.c:577 #23 0xc0159167 in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:235 #24 0xc0159814 in poweroff_wait (junk=0xc02af179, howto=-1070928849) at /usr/src/sys/kern/kern_shutdown.c:595 #25 0xc0270c3d in trap_fatal (frame=0xe026cdcc, eva=144130616) at /usr/src/sys/i386/i386/trap.c:974 #26...

...ff7fce00, p=0xfcee6d00, cred=0xc74ba800) at vnode_if.h:1383 #13 0xc0190af1 in namei (ndp=0xfd05bec4) at ../../kern/vfs_lookup.c:171 #14 0xc0199c85 in vn_open (ndp=0xfd05bec4, fmode=5, cmode=2180) at ../../kern/vfs_vnops.c:138 #15 0xc0195c98 in open (p=0xfcee6d00, uap=0xfd05bf80) at ../../kern/vfs_syscalls.c:1028 #16 0xc0215195 in syscall2 (frame={tf_fs = 134545455, tf_es = 134545455, tf_ds = -1078001617, tf_edi = 134597120, tf_esi = -1077937628, tf_ebp = -1077937532, tf_isp = -49954860, tf_ebx = 672099916, tf_edx = 134597184, tf_ecx = 134557696, tf_eax = 5, tf_trapno = 0, tf_err...

...d_loop(p); + if (stratcalls != 0 && syncer_maxdelay < + abs(time_second - starttime)) { + rushjob = syncer_maxdelay; + break; + } + } + else { tsleep(&lbolt, PPAUSE, "syncer", 0); + kproc_suspend_loop(p); + } } } --- /usr/src/sys.org/kern/vfs_syscalls.c Thu Jan 2 18:26:18 2003 +++ kern/vfs_syscalls.c Sat Apr 12 01:55:48 2003 @@ -563,6 +563,9 @@ sync(p, uap) register struct mount *mp, *nmp; int asyncflag; + /* Notify sched_sync() to try flushing syncer_workitem_pending[*] */ + rushjob += syncer_maxdelay; + simple_lock(&mountlist_s...