From Ville.Eerola@vlsi.fi  Mon Oct  2 04:17:19 1995
Received: from vlsi1.vlsi.fi (CQ4aA/9/+IDXiYbolMq/SHsdN/uxPNYx@vlsi1.vlsi.fi [193.64.2.2])
          by freefall.freebsd.org (8.6.12/8.6.6) with ESMTP id EAA07925
          for <FreeBSD-gnats-submit@freebsd.org>; Mon, 2 Oct 1995 04:16:13 -0700
Received: from layout.vlsi.fi by vlsi1.vlsi.fi with ESMTP
	(1.37.109.16/16.2) id AA084730573; Mon, 2 Oct 1995 12:42:53 +0200
Received: by layout.vlsi.fi
	(1.37.109.15/16.2) id AA059990572; Mon, 2 Oct 1995 12:42:52 +0200
Message-Id: <199510021042.AA059990572@layout.vlsi.fi>
Date: Mon, 2 Oct 1995 12:42:52 +0200
From: Ville Eerola <ville@vlsi.fi>
Reply-To: ville@vlsi.fi
To: FreeBSD-gnats-submit@freebsd.org
Subject: mv foo/ ../.. causes panic
X-Send-Pr-Version: 3.2

>Number:         760
>Category:       kern
>Synopsis:       mv foo/ ../.. causes panic
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Oct  2 04:20:01 PDT 1995
>Closed-Date:    Sat Oct 7 03:43:06 PDT 1995
>Last-Modified:  Sat Oct  7 03:53:09 PDT 1995
>Originator:     Ville Eerola
>Release:        FreeBSD 2.1-STABLE i386
>Organization:
VLSI Solution Oy
>Environment:

FreeBSD 2.1-STABLE #0: Sun Sep 17 23:18:24 EET DST 1995
    ville@descent.vlsi.fi:/usr/src/sys/compile/DESCENT
CPU: 120-MHz Pentium 735\\90 or 815\\100 (Pentium-class CPU)
  Origin = "GenuineIntel"  Id = 0x525  Stepping=5
  Features=0x1bf<FPU,VME,PSE,MCE,CX8,APIC>
real memory  = 33554432 (32768K bytes)
avail memory = 30838784 (30116K bytes)
Probing for devices on the ISA bus:
sc0 at 0x60-0x6f irq 1 on motherboard
sc0: VGA color <4 virtual consoles, flags=0x0>
sio0 at 0x3f8-0x3ff irq 4 on isa
sio0: type 16550A
sio1 at 0x2f8-0x2ff irq 3 on isa
sio1: type 16550A
lpt0 at 0x378-0x37f irq 7 on isa
lpt0: Interrupt-driven port
lp0: TCP/IP capable interface
fdc0 at 0x3f0-0x3f7 irq 6 drq 2 on isa
fdc0: NEC 72065B
fd0: 1.44MB 3.5in
wdc0 not found at 0x1f0
1 3C5x9 board(s) on ISA found at 0x300
ep0 at 0x300-0x30f irq 10 on isa
ep0: aui/bnc[*BNC*] address 00:20:af:56:15:5b irq 10
npx0 on motherboard
npx0: INT 16 interface
Probing for devices on the PCI bus:
chip0 <Intel 82437 (Triton)> rev 2 on pci0:0
chip1 <Intel 82371 (Triton)> rev 2 on pci0:7
vga0 <VGA-compatible display device> rev 0 int a irq 11 on pci0:13
ahc0 <Adaptec 2940 SCSI host adapter> rev 0 int a irq 9 on pci0:15
ahc0: reading board settings
ahc0: Reading SEEPROM...done.
ahc0: 2940 Single Channel, SCSI Id=7, aic7870, 16 SCBs
ahc0: Downloading Sequencer Program...Done
ahc0: Probing channel A
ahc0 waiting for scsi devices to settle
ahc0: target 0 synchronous at 10.0MB/s, offset = 0xf
ahc0: target 0 Tagged Queuing Device
(ahc0:0:0): "SEAGATE ST31230N 0300" type 0 fixed SCSI 2
sd0(ahc0:0:0): Direct-Access 1010MB (2069860 512 byte sectors)
ahc0: target 1 synchronous at 10.0MB/s, offset = 0xf
ahc0: target 1 Tagged Queuing Device
(ahc0:1:0): "SEAGATE ST31230N 0300" type 0 fixed SCSI 2
sd1(ahc0:1:0): Direct-Access 1010MB (2069860 512 byte sectors)

>Description:
[note that ../.. is owned by root, and cannot be written by normal users]

Executing the following commands cause panic:
descent% mkdir foo
descent% mv foo/ ../..

This results:
panic: relookup: lookup on dot-dot

It appears that mv tries to rename foo/ to ../../ which would cause bad
things to happen if succesful.

However, the following variants do not cause anything bad to happen:
descent% mv foo ../../
mv: rename foo to ../..//foo: Permission denied
descent% mv foo ../..
mv: rename foo to ../../foo: Permission denied
descent% mv foo/ ..
mv: rename foo/ to ../: Directory not empty

>How-To-Repeat:
See above...

>Fix:


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: bde 
State-Changed-When: Sat Oct 7 03:43:06 PDT 1995 
State-Changed-Why:  
Fixed in the current versions of /sys/ufs/ufs/ufs_vnops.c, 
/sys/msdosfs/msdosfs_vnops.c and /usr/src/bin/mv/mv.c. 
/bin/mv built the wrong target pathname ("../../" instead 
of "../../foo/") and the kernel couldn't handle renames of 
directories to paths ending in "../" or "..". 
>Unformatted:
