Date: Mon, 22 Apr 2019 00:52:15 -0700 From: Enji Cooper <yaneurabeya@gmail.com> To: Hans Petter Selasky <hselasky@FreeBSD.org> Cc: src-committers <src-committers@freebsd.org>, svn-src-all <svn-src-all@freebsd.org>, svn-src-head@freebsd.org Subject: Re: svn commit: r346530 - in head/sys: netinet netinet6 Message-ID: <2F3D6B17-AF4F-4B0F-B20E-5EF41DE851F9@gmail.com> In-Reply-To: <201904220727.x3M7ROpR009729@repo.freebsd.org> References: <201904220727.x3M7ROpR009729@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
> On Apr 22, 2019, at 12:27 AM, Hans Petter Selasky = <hselasky@FreeBSD.org> wrote: >=20 > Author: hselasky > Date: Mon Apr 22 07:27:24 2019 > New Revision: 346530 > URL: https://svnweb.freebsd.org/changeset/base/346530 >=20 > Log: > Fix panic in network stack due to memory use after free in relation = to > fragmented packets. >=20 > When sending IPv4 and IPv6 fragmented packets and a fragment is lost, > the mbuf making up the fragment will remain in the temporary hashed > fragment list for a while. If the network interface departs before = the > so-called slow timeout clears the packet, the fragment causes a panic > when the timeout kicks in due to accessing a freed network interface > structure. >=20 > Make sure that when a network device is departing, all hashed IPv4 = and > IPv6 fragments belonging to it, get freed. >=20 > Backtrace: > panic() > icmp6_reflect() >=20 > hlim =3D ND_IFINFO(m->m_pkthdr.rcvif)->chlim; > ^^^^ rcvif->if_afdata[AF_INET6] is NULL. >=20 > icmp6_error() > frag6_freef() > frag6_slowtimo() > pfslowtimo() > softclock_call_cc() > softclock() > ithread_loop() >=20 > Differential Revision: https://reviews.freebsd.org/D19622 > Reviewed by: bz (network), adrian > MFC after: 1 week > Sponsored by: Mellanox Technologies This commit broke the build on mips, etc: 07:36:06=20 --- ip_reass.o --- 07:36:06=20 /usr/src/sys/netinet/ip_reass.c:641: error: expected ')' before '(' = token 07:36:06 *** [ip_reass.o] Error code 1 EVENTHANDLER_DEFINE looks like it doesn=E2=80=99t work with gcc? Thanks, -Enji=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?2F3D6B17-AF4F-4B0F-B20E-5EF41DE851F9>