Date: Mon, 17 Sep 2001 17:13:25 +0200 (CEST) From: brandt@fokus.gmd.de To: FreeBSD-gnats-submit@freebsd.org Subject: kern/30630: Failure to check for existence of interface in if_mib.c Message-ID: <200109171513.f8HFDPP78343@fokus.gmd.de>
next in thread | raw e-mail | index | archive | help
>Number: 30630 >Category: kern >Synopsis: Failure to check for existence of interface in if_mib.c >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Sep 17 08:20:02 PDT 2001 >Closed-Date: >Last-Modified: >Originator: Hartmut Brandt >Release: FreeBSD 5.0-CURRENT i386 >Organization: Frauenhofer FOKUS >Environment: System: FreeBSD beagle.fokus.gmd.de 5.0-CURRENT FreeBSD 5.0-CURRENT #0: Wed Sep 5 12:10:46 CEST 2001 hbb@beagle.fokus.gmd.de:/opt/obj/usr/src/sys/BEAGLE i386 >Description: if_mib.c:sysctl_ifdata fails to check whether the accessed interface really exists. The problem is, that since the advent of loadable modules the interface index name space may be sparse. Before loadable modules one was sure that all interfaces between 1 and if_index really exists so the check if (name[0] <= 0 || name[0] > if_index) was ok. Now it is possible to unload interface drivers so that interfaces between 1 and if_index may disappear. ifaddr_byindex(IDX) will return NULL in this case which in turn leads to a kernel panic. There may be other places in the kernel that also build on the old assumption. >How-To-Repeat: Put 2 network cards in your computer which need different drivers. Build these drivers as loadable modules and reboot. Now configure the two interfaces. Now unload the driver for the first interface and execute the test program below: # include "stdio.h" # include "err.h" # include "sys/types.h" # include "sys/sysctl.h" # include "sys/socket.h" # include "net/if.h" # include "net/if_mib.h" int main(int argc, char *argv[]) { int name[6]; size_t len; name[0] = CTL_NET; name[1] = PF_LINK; name[2] = NETLINK_GENERIC; name[3] = IFMIB_IFDATA; name[4] = 4; name[5] = IFDATA_LINKSPECIFIC; if (sysctl(name, 6, NULL, &len, NULL, 0) < 0) { err(1, "sysctl failed"); return (1); } return (0); } Watch the kernel panic. >Fix: Index: if_mib.c =================================================================== RCS file: /usr/ncvs/src/sys/net/if_mib.c,v retrieving revision 1.11 diff -r1.11 if_mib.c 86c86,87 < ifp = ifaddr_byindex(name[0])->ifa_ifp; --- > if ((ifp = ifaddr_byindex(name[0])->ifa_ifp) == NULL) > return (ENOENT); >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200109171513.f8HFDPP78343>