Date: Sun, 4 Mar 2001 04:47:42 -0600 (CST) From: zach@uffdaonline.net To: FreeBSD-gnats-submit@freebsd.org Subject: kern/25519: -STABLE crash from ordinary user (newpcm related) Message-ID: <20010304104742.3F65AA7B@uffdaonline.net>
next in thread | raw e-mail | index | archive | help
>Number: 25519 >Category: kern >Synopsis: -STABLE crash from ordinary user (newpcm related) >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Mar 04 02:50:01 PST 2001 >Closed-Date: >Last-Modified: >Originator: Zach N. Heilig >Release: FreeBSD 4.2-STABLE i386 >Organization: none >Environment: >Description: simply: panic: page fault (that's the only message after the current time from /etc/rc and before 'synching disks...') >How-To-Repeat: compile and run this code (as any user that has read/write access to the sound driver): --- snip --- #include <machine/soundcard.h> #include <fcntl.h> #include <signal.h> #include <stdio.h> #include <string.h> #include <unistd.h> void fast_writer(void); void slow_reader(void); void wakeup(int s) { } int main(void) { sigset_t none; int child; child = fork(); if (child == 0) fast_writer(); /* let the writer set up the channel properly... */ signal(SIGUSR1, wakeup); sigemptyset(&none); sigsuspend(&none); /* and let it get a bit ahead... */ sleep(5); slow_reader(); return 0; } void fast_writer(void) { int parent; int fd; int format = AFMT_S16_LE; int speed = 44100; int bits = 16; int stereo = 1; char out[17640]; parent = getppid(); memset(out, 0, sizeof out); fprintf(stderr, "pid %d\n", getpid()); fd = open("/dev/dsp", O_WRONLY); if (fd == -1) { perror("fast_writer: unable to open /dev/dsp"); kill(parent, SIGUSR1); exit(1); } ioctl(fd, SNDCTL_DSP_SETFMT, &format); ioctl(fd, SNDCTL_DSP_SPEED, &speed); ioctl(fd, SNDCTL_DSP_SAMPLESIZE, &bits); ioctl(fd, SNDCTL_DSP_STEREO, &stereo); fprintf(stderr, "fast_writer: starting loop\n"); kill(parent, SIGUSR1); while (1) { write(fd, out, sizeof out); write(STDOUT_FILENO, ">", 1); } } void slow_reader(void) { int cnt; int fd; int in[1600]; fprintf(stderr, "pid %d\n", getpid()); open("/dev/dspW", O_WRONLY); fd = open("/dev/dspW", O_RDONLY); if (fd == -1) { perror("slow_reader: unable to open /dev/dsp"); exit(1); } fprintf(stderr, "slow_reader: starting loop\n"); for (cnt = 0; cnt < 10; ++cnt) { read(fd, in, sizeof in); write(STDOUT_FILENO, "<", 1); } exit(0); } --- snip --- >Fix: >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010304104742.3F65AA7B>