Date: Thu, 15 May 2003 13:49:42 +0900 (JST) From: Jinmei Tatuya <jinmei@isl.rdc.toshiba.co.jp> To: FreeBSD-gnats-submit@FreeBSD.org Subject: kern/52260: sys/net/if.c:if_detach in FreeBSD4 forgets resetting the ifindex2ifnet array Message-ID: <200305150449.h4F4ngYL084992@shuttle.wide.toshiba.co.jp> Resent-Message-ID: <200305150450.h4F4o5Z3019138@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 52260 >Category: kern >Synopsis: sys/net/if.c:if_detach in FreeBSD4 forgets resetting the ifindex2ifnet array >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed May 14 21:50:05 PDT 2003 >Closed-Date: >Last-Modified: >Originator: Jinmei Tatuya >Release: FreeBSD 4.8-RELEASE i386 >Organization: Toshiba Corporation / the KAME Project >Environment: System: FreeBSD tachyon.jinmei.org 4.8-RELEASE FreeBSD 4.8-RELEASE #7: Thu May 8 22:57:19 JST 2003 jinmei@tachyon.jinmei.org:/home/jinmei/src/kame/kame/freebsd4/sys/compile/TACHYON_SCTP i386 machine: Toshiba Portege 2000 OS:FreeBSD 4.8 + KAME snap from the repository (around 20030510) (the bug is not specific to KAME snap, though) >Description: sys/net/if.c:if_detach() does not NULL-clear the corresponding ifindex2ifnet[] entry, so if we try to reuse the interface index for a detached interface, the kernel will refer to a dangling pointer and cause an unexpected behavior (perhaps a crash). FreeBSD current apparently does not have this bug. But this is quite critical, so I believe we should fix this on the FreeBSD-4 branch as well. >How-To-Repeat: I can't always reproduce the bug, but I once saw a kernel crash due to this when I remove an IEEE 802 PCMCIA device from the laptop while running rtsold on the wireless interface. >Fix: The following is a patch to FreeBSD 4.8 RELEASE to fix this. --- if.c.orig Thu May 15 12:58:18 2003 +++ if.c Thu May 15 12:58:37 2003 @@ -310,6 +310,7 @@ /* Announce that the interface is gone. */ rt_ifannouncemsg(ifp, IFAN_DEPARTURE); + ifindex2ifnet[ifp->if_index] = NULL; TAILQ_REMOVE(&ifnet, ifp, if_link); splx(s); } >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200305150449.h4F4ngYL084992>