Subject: Re: NetBSD Security Advisory 1999-008
To: Bill Studenmund <skippy@macro.Stanford.EDU>
From: Simon Burge <simonb@telstra.com.au>
List: current-users
Date: 04/15/1999 12:45:32
Bill Studenmund wrote:
> On Wed, 14 Apr 1999, Matthew Orgass wrote:
>
> > On Wed, 14 Apr 1999, Matthew Orgass wrote:
> >
> > > However, the advisory was unclear in that on 1.3.3 it is not the ln that
> > > triggers the hang but an ls afterwards.
> >
> > Also unclear in the advisory is that 1.4_ALPHA only panics if you try
> > linking your current directory. If you do the same thing (+ ls) but link
> > a different directory, it too hangs.
>
> You're right that the advisory was unclear, but it's not "a different
> directory" which is the problem, but if the text of the symlink starts
> with a "/" or not.
>
> Say you're in /tmp/a, and /tmp/b exists.
>
> ln -s ../b/ foo
> ln -s ../b/ foo
>
> will give the locking panic.
Ok, on my 1.3.almost4 pmax this gives ln sleeping on the bogus wait
channel (ps lxww):
7006 1810 225 10 -14 0 72 52 404a1100 D+ p0 0:00.11 ln -s ../b/ foo
> ln -s /tmp/b/ foo
> ln -s /tmp/b/ foo
>
> will hang whenever you do something like an ls.
And this a blocked ls (ps lxww):
7006 278 225 14 -14 0 304 88 404e0500 D p0 0:00.14 ls
So you're saying that the first case (with relative pathname) would
panic a 1.4ish box?
Simon.