It appears that the strange non-fatal udp panic I have been able to produce is
caused by socktest illegally trying to call accept() on an ip6 udp socket. ip4
correctly returns an error while ip6 panics. illegally calling listen() though
correctly returns an error under ip6. So somewhere in the ip6 code accept is
failing to check that the socket is a tcp socket.
To exploit it, just bind a udp port, and then call accept on it. The program
segfaults and the port becomes "stuck" and can't be successfully bound to again.
If someone wants a sample program that does this, or a panic trace, let me know.
David "LordBeatnik" Jeffery
----------------------
Do you do Linux? :)
Get your FREE @linuxstart.com email address at: http://www.linuxstart.com
|