Date: Wed, 27 Jan 2016 02:08:30 +0000 (UTC) From: Luigi Rizzo <luigi@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r294879 - head/sys/netpfil/ipfw Message-ID: <201601270208.u0R28UdV056477@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: luigi Date: Wed Jan 27 02:08:30 2016 New Revision: 294879 URL: https://svnweb.freebsd.org/changeset/base/294879 Log: bugfix: the scheduler template (dn_schk) for the round robin scheduler is followed by another structure (rr_schk) whose size must be set in the schk_datalen field of the descriptor. Not allocating the memory may cause other memory to be overwritten (though dn_schk is 192 bytes and rr_schk only 12 so we may be lucky and end up in the padding after the dn_schk). This is a merge candidate for stable and 10.3 MFC after: 3 days Modified: head/sys/netpfil/ipfw/dn_sched_rr.c Modified: head/sys/netpfil/ipfw/dn_sched_rr.c ============================================================================== --- head/sys/netpfil/ipfw/dn_sched_rr.c Wed Jan 27 01:33:26 2016 (r294878) +++ head/sys/netpfil/ipfw/dn_sched_rr.c Wed Jan 27 02:08:30 2016 (r294879) @@ -294,7 +294,7 @@ static struct dn_alg rr_desc = { _SI( .name = ) "RR", _SI( .flags = ) DN_MULTIQUEUE, - _SI( .schk_datalen = ) 0, + _SI( .schk_datalen = ) sizeof(struct rr_schk), _SI( .si_datalen = ) sizeof(struct rr_si), _SI( .q_datalen = ) sizeof(struct rr_queue) - sizeof(struct dn_queue), @@ -311,5 +311,6 @@ static struct dn_alg rr_desc = { _SI( .free_queue = ) rr_free_queue, }; +_Static_assert(sizeof(struct dn_schk) < 193, "a"); DECLARE_DNSCHED_MODULE(dn_rr, &rr_desc);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201601270208.u0R28UdV056477>