Crash a RISC machine from user-mode code:

[Dominic Dunlop]

In article <1826 at mountn.dec.com> akhiani at ricks.enet.dec.com
(Homayoon Akhiani) writes:
> This is what I got through EMAIL:(Very intresting)
> 
> From: DECWRL::"zaphod.mps.ohio-state.edu!usc!samsung!mitech!gjc at tut.cis.ohio-state.edu" "MAIL-11 Daemon" 31-JUL-1990 00:03:39.91
> To:	info-vax at kl.sri.com 
> Subj:	how to crash a RISC machine from user-mode code: !!! 
> 
> I am posting [crashme.c] to info-vax because lots of people on this list
> would have SUN-4's or other RISC machines to try it on, and we VAX
> users could use a good chuckle from time to time.
> ...  
> On the few SUN-4's I've tried: this allows a user-mode program to
> crash the system....

[Other respondents have reported the shooting down of other RISCs, and
(somewhat) less catastrophic results on a few CISCs.]

Well.  On my ``A/UX tsa 1.1 SVR2 mc68020'' (Mac IIx running A/UX 1.1)
crashme does not actually crash the system.  (I used the standard C
compiler, which has an AT&T/Unisoft/Apple pedigree (if that's the right
word).)  However...

	$ crashme 4096 0 64
	crashem 4096 0 64
	Badboy at 4199624. 0x4014C8
	0
	Got signal 4 illegal instruction
	Barfed
	1
	Got signal 4 illegal instruction
	Barfed
	2
	Got signal 11 segmentation violation
	Barfed
	3
	Got signal 11 segmentation violation
	Barfed
	4
	Got signal 11 segmentation violation
	Barfed
	5
	Got signal 4 illegal instruction
	Barfed
	6
	Got signal 4 illegal instruction
	Barfed
	7
	Got signal 11 segmentation violation
	Barfed
	8
	Got signal 4 illegal instruction
	Barfed
	...

A short time after this, the program gets stuck in a silent loop. Some
time later, my system sprouts a rash of "Warning: swap space is low"s,
the disk threatens to shake itself to bits, other processes start
aborting, and response becomes snail-like.  But crashme eventually
responds if sent a quit signal, and, after more feverish disk activity,
the system recovers.

I don't know precisely what's going on, but presume it's something a
purpose-built malevolent user-mode program could do on any system
(whether CISC or RISC) without user time and memory space quotas...
-- 
Dominic Dunlop