Subject: Re: NetBSD Security Advisory 1999-008
To: Bill Studenmund <skippy@macro.Stanford.EDU>
From: Simon Burge <simonb@telstra.com.au>
List: current-users
Date: 04/15/1999 12:45:32
Bill Studenmund wrote:

> On Wed, 14 Apr 1999, Matthew Orgass wrote:
> 
> > On Wed, 14 Apr 1999, Matthew Orgass wrote:
> > 
> > >   However, the advisory was unclear in that on 1.3.3 it is not the ln that
> > > triggers the hang but an ls afterwards.
> > 
> >   Also unclear in the advisory is that 1.4_ALPHA only panics if you try
> > linking your current directory.  If you do the same thing (+ ls) but link 
> > a different directory, it too hangs.
> 
> You're right that the advisory was unclear, but it's not "a different
> directory" which is the problem, but if the text of the symlink starts
> with a "/" or not.
> 
> Say you're in /tmp/a, and /tmp/b exists.
> 
> ln -s ../b/ foo
> ln -s ../b/ foo
> 
> will give  the locking panic.

Ok, on my 1.3.almost4 pmax this gives ln sleeping on the bogus wait
channel (ps lxww):

	7006 1810 225 10 -14 0 72 52 404a1100 D+ p0 0:00.11 ln -s ../b/ foo 

> ln -s /tmp/b/ foo
> ln -s /tmp/b/ foo
> 
> will hang whenever you do something like an ls.

And this a blocked ls (ps lxww):

	7006 278 225 14 -14 0 304 88 404e0500 D p0 0:00.14 ls 

So you're saying that the first case (with relative pathname) would
panic a 1.4ish box?

Simon.