Re: Panic from bad length parameter in bind (Possible DOS attack)

From: Pawel Jakub Dawidek <pjd_at_FreeBSD.org>
Date: Sun, 4 Apr 2004 00:32:30 +0200
On Sat, Apr 03, 2004 at 02:21:08PM -0700, Ryan Sommers wrote:
+> Whenever I supply a length of 4 as the final bind parameter I get the
+> following panic. Looks like bind returns fine, however, when the program
+> exits it stumbles over some mutex associated with the descriptor. The
+> mutex passed to mtx_destroy() has MTX_RECURSED set. I attempted to find
+> where the call to bind was clobbering the mutex but couldn't. I attached
+> the simple program to exploit this. I was able to do it as a regular user.

Yes, could you try this patch:

	http://people.freebsd.org/~pjd/patches/tcp_usrreq.c.patch

-- 
Pawel Jakub Dawidek                       http://www.FreeBSD.org
pjd_at_FreeBSD.org                           http://garage.freebsd.pl
FreeBSD committer                         Am I Evil? Yes, I Am!

Received on Tue Apr 06 2004 - 07:35:54 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:50 UTC