From owner-freebsd-net@FreeBSD.ORG  Tue Jan 13 20:58:07 2015
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id B82F7E79
 for <freebsd-net@FreeBSD.org>; Tue, 13 Jan 2015 20:58:07 +0000 (UTC)
Received: from kenobi.freebsd.org (kenobi.freebsd.org
 [IPv6:2001:1900:2254:206a::16:76])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 9EB17B11
 for <freebsd-net@FreeBSD.org>; Tue, 13 Jan 2015 20:58:07 +0000 (UTC)
Received: from bugs.freebsd.org ([127.0.1.118])
 by kenobi.freebsd.org (8.14.9/8.14.9) with ESMTP id t0DKw7uZ091087
 for <freebsd-net@FreeBSD.org>; Tue, 13 Jan 2015 20:58:07 GMT
 (envelope-from bugzilla-noreply@freebsd.org)
From: bugzilla-noreply@freebsd.org
To: freebsd-net@FreeBSD.org
Subject: [Bug 172675] [netinet] [patch] sysctl_tcp_hc_list
 (net.inet.tcp.hostcache.list) race condition causing memory corruption
Date: Tue, 13 Jan 2015 20:58:07 +0000
X-Bugzilla-Reason: AssignedTo
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: Base System
X-Bugzilla-Component: kern
X-Bugzilla-Version: 8.3-RELEASE
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: Affects Only Me
X-Bugzilla-Who: jhb@FreeBSD.org
X-Bugzilla-Status: In Progress
X-Bugzilla-Priority: Normal
X-Bugzilla-Assigned-To: freebsd-net@FreeBSD.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: cc attachments.created
Message-ID: <bug-172675-2472-A8S9hRgmTh@https.bugs.freebsd.org/bugzilla/>
In-Reply-To: <bug-172675-2472@https.bugs.freebsd.org/bugzilla/>
References: <bug-172675-2472@https.bugs.freebsd.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 13 Jan 2015 20:58:07 -0000

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=172675

John Baldwin <jhb@FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jhb@FreeBSD.org

--- Comment #6 from John Baldwin <jhb@FreeBSD.org> ---
Created attachment 151584
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=151584&action=edit
sbuf_hc_list.patch

It is true that cache_count updates are very racy, and it might be worth fixing
them to be atomic.  However, those would not prevent the corruption.  If the
cache grew during the sysctl even with the atomic ops you could still overflow
the buffer.

I started out by adding explicit checks of 'p - buf >= bufsize' to break out of
the loop.  However, the sbuf(9) API already provides a nice way to handle
variable output into a fixed size buffer while handling overflow correctly,
etc.  I've attached a patch which takes this route and converts the sysctl to
use an sbuf instead.  Please test.

-- 
You are receiving this mail because:
You are the assignee for the bug.