From swear@blarg.net  Sun Oct 14 12:00:24 2001
Return-Path: <swear@blarg.net>
Received: from lists.blarg.net (lists.blarg.net [206.124.128.17])
	by hub.freebsd.org (Postfix) with ESMTP id 01FD137B405
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 14 Oct 2001 12:00:24 -0700 (PDT)
Received: from thig.blarg.net (thig.blarg.net [206.124.128.18])
	by lists.blarg.net (Postfix) with ESMTP id 9F3CBBD1C
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 14 Oct 2001 12:00:23 -0700 (PDT)
Received: from localhost.localdomain ([206.124.139.115])
	by thig.blarg.net (8.9.3/8.9.3) with ESMTP id MAA08913
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 14 Oct 2001 12:00:23 -0700
Received: (from jojo@localhost)
	by localhost.localdomain (8.11.6/8.11.3) id f9EIxZ157022;
	Sun, 14 Oct 2001 11:59:35 -0700 (PDT)
	(envelope-from swear@blarg.net)
Message-Id: <ee8zeenj3c.zee@localhost.localdomain>
Date: 14 Oct 2001 11:59:35 -0700
From: "Gary W. Swearingen" <swear@blarg.net>
Reply-To: swear@blarg.net
To: FreeBSD-gnats-submit@freebsd.org
Subject: System can be crashed with "ls -al /floppy".
X-GNATS-Notify:

>Number:         31266
>Category:       kern
>Synopsis:       System can be crashed with "ls -al /floppy".
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    linimon
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Oct 14 12:10:03 PDT 2001
>Closed-Date:    Mon Apr 03 21:56:37 GMT 2006
>Last-Modified:  Mon Apr 03 21:56:37 GMT 2006
>Originator:     Gary W. Swearingen
>Release:        FreeBSD 4.3-STABLE i386 (02'jun'01, I think)
>Organization:
none
>Environment:
i386, custom kernel otherwise working fine
Jul 31 21:35:19 localhost /kernel: Origin = "AuthenticAMD"  Id = 0x58c  Stepping = 12
Jul 31 21:35:19 localhost /kernel: Features=0x8021bf<FPU,VME,DE,PSE,TSC,MSR,MCE,CX8,PGE,MMX>
Jul 31 21:35:19 localhost /kernel: AMD Features=0x80000800<SYSCALL,3DNow!>
Jul 31 21:35:20 localhost /kernel: real memory  = 67108864 (65536K bytes)
Jul 31 21:35:20 localhost /kernel: avail memory = 62042112 (60588K bytes)
Jul 31 21:35:20 localhost /kernel: Preloaded elf kernel "kernel" at 0xc032a000.
Jul 31 21:35:20 localhost /kernel: Preloaded userconfig_script "/boot/kernel.conf" at 0xc032a09c.
Jul 31 21:35:20 localhost /kernel: K6-family MTRR support enabled (2 registers)
Jul 31 21:35:20 localhost /kernel: md0: Malloc disk
Jul 31 21:35:20 localhost /kernel: npx0: <math processor> on motherboard
Jul 31 21:35:20 localhost /kernel: npx0: INT 16 interface
Jul 31 21:35:20 localhost /kernel: pcib0: <Host to PCI bridge> on motherboard
Jul 31 21:35:20 localhost /kernel: pci0: <PCI bus> on pcib0
Jul 31 21:35:20 localhost /kernel: pcib2: <VIA 82C598MVP (Apollo MVP3) PCI-PCI (AGP) bridge> at device 1.0 on pci0
Jul 31 21:35:20 localhost /kernel: pci1: <PCI bus> on pcib2
Jul 31 21:35:20 localhost /kernel: pci1: <NVidia Riva Vanta TNT2 graphics accelerator> at 0.0
Jul 31 21:35:20 localhost /kernel: isab0: <VIA 82C586 PCI-ISA bridge> at device 7.0 on pci0
Jul 31 21:35:20 localhost /kernel: isa0: <ISA bus> on isab0
Jul 31 21:35:20 localhost /kernel: atapci0: <VIA 82C586 ATA33 controller> port 0xe000-0xe00f at device 7.1 on pci0
Jul 31 21:35:20 localhost /kernel: ata0: at 0x1f0 irq 14 on atapci0
Jul 31 21:35:20 localhost /kernel: ata1: at 0x170 irq 15 on atapci0
Jul 31 21:35:20 localhost /kernel: pcib1: <Host to PCI bridge> on motherboard
Jul 31 21:35:20 localhost /kernel: pci2: <PCI bus> on pcib1
Jul 31 21:35:20 localhost /kernel: fdc0: <NEC 72065B or clone> at port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on isa0
Jul 31 21:35:20 localhost /kernel: fdc0: FIFO enabled, 8 bytes threshold
Jul 31 21:35:20 localhost /kernel: fd0: <1440-KB 3.5" drive> on fdc0 drive 0
================
>Description:

My system crashed two (or three) times (once just after booting after
the previous crash and before starting X server) when I used "ls -al /a"
where /a was a read-only floppy mounted read/write.
================
>How-To-Repeat:

--  Put 3 empty files on a 1.44 MB floppy. (M$FAT)
--  Set slide on floppy to read-only position.
--  Mount it r/w (-t msdos) on /a and then do: rm /a/*
--  Prepare for crash and then do: ls -al /a

I haven't yet tried this on 4.4.  I've made a note to test this
the next time I reboot.
================
>Fix:

Workaround: Don't Do That (TM)
>Release-Note:
>Audit-Trail:

From: "Crist J. Clark" <cristjc@earthlink.net>
To: "Gary W. Swearingen" <swear@blarg.net>
Cc: FreeBSD-gnats-submit@FreeBSD.ORG
Subject: Re: misc/31266: System can be crashed with "ls -al /floppy".
Date: Sun, 14 Oct 2001 15:40:03 -0700

 On Sun, Oct 14, 2001 at 11:59:35AM -0700, Gary W. Swearingen wrote:
 
 > >How-To-Repeat:
 > 
 > --  Put 3 empty files on a 1.44 MB floppy. (M$FAT)
 > --  Set slide on floppy to read-only position.
 > --  Mount it r/w (-t msdos) on /a and then do: rm /a/*
 > --  Prepare for crash and then do: ls -al /a
 > 
 > I haven't yet tried this on 4.4.  I've made a note to test this
 > the next time I reboot.
 
 It works on 4.4-STABLE. You get a nice freeze up, no panic.
 -- 
 Crist J. Clark                     |     cjclark@alum.mit.edu
                                    |     cjclark@jhu.edu
 http://people.freebsd.org/~cjc/    |     cjc@freebsd.org

From: Tilman Linneweh <tilman@arved.de>
To: freebsd-gnats-submit@FreeBSD.org, swear@blarg.net
Cc:  
Subject: Re: misc/31266: System can be crashed with "ls -al /floppy".
Date: Mon, 8 Jul 2002 22:27:18 +0200

 This Bug still works on 4.6-Release and 5.0-CURRENT.
 
 Still no solution ?
 
 regards
 arved
Responsible-Changed-From-To: freebsd-bugs->cjc 
Responsible-Changed-By: dougb 
Responsible-Changed-When: Wed Jul 10 01:08:19 PDT 2002 
Responsible-Changed-Why:  
Crist, can you follow up with this user? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=31266 

From: "KAREN THODE" <thode12@msn.com>
To: <freebsd-gnats-submit@FreeBSD.org>, <swear@blarg.net>
Subject: Re: misc/31266: System can be crashed with "ls -al /floppy".
Date: Sat, 17 May 2003 20:06:52 -0500

 The fix that will squash this bug once and for all is to modify mount so =
 that a read-only removable device cannot be mounted read/write.
 
 Lucas
State-Changed-From-To: open->feedback 
State-Changed-By: linimon 
State-Changed-When: Mon Apr 3 21:30:01 UTC 2006 
State-Changed-Why:  
Is this still a problem with recent versions of FreeBSD? 


Responsible-Changed-From-To: cjc->linimon 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Mon Apr 3 21:30:01 UTC 2006 
Responsible-Changed-Why:  
Reset PR assigned to inactive committer who has not responded to email. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=31266 
State-Changed-From-To: feedback->closed 
State-Changed-By: linimon 
State-Changed-When: Mon Apr 3 21:56:05 UTC 2006 
State-Changed-Why:  
Submitter's email address bounces. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=31266 
>Unformatted:
