Date: Fri, 29 May 2009 22:48:55 GMT From: Mateusz Guzik <mjguzik@gmail.com> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/135067: [patch][fib] Incorrect KASSERTs in sys/net/route.c Message-ID: <200905292248.n4TMmtRN005295@www.freebsd.org> Resent-Message-ID: <200905292250.n4TMo3S4035476@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 135067
>Category: kern
>Synopsis: [patch][fib] Incorrect KASSERTs in sys/net/route.c
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Fri May 29 22:50:03 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator: Mateusz Guzik
>Release: 8.0-CURRENT
>Organization:
>Environment:
FreeBSD eternal 8.0-CURRENT FreeBSD 8.0-CURRENT #2: Fri May 29 23:33:10 CEST 2009 f@eternal:/usr/obj/usr/src/sys/ETERNAL i386
>Description:
setfib() compares like this: uap->fibnum >= rt_numfibs
but KASSERT(fibnum < rt_numfibs) used in various places does not catch the case when fibnum == rt_numfibs. I believe it should be 'fibnum <= rt_numfibs' to match the check performed in setfib (and not read/write past rt_tables if fibnum == rt_numfibs == RT_MAXFIBS).
>How-To-Repeat:
>Fix:
Patch attached with submission follows:
--- route.c.orig 2009-05-02 07:02:28.000000000 +0200
+++ route.c 2009-05-30 00:23:45.000000000 +0200
@@ -297,7 +297,7 @@
int err = 0, msgtype = RTM_MISS;
int needlock;
- KASSERT((fibnum < rt_numfibs), ("rtalloc1_fib: bad fibnum"));
+ KASSERT((fibnum <= rt_numfibs), ("rtalloc1_fib: bad fibnum"));
if (dst->sa_family != AF_INET) /* Only INET supports > 1 fib now */
fibnum = 0;
rnh = V_rt_tables[fibnum][dst->sa_family];
@@ -936,7 +936,7 @@
struct sockaddr *ndst;
#define senderr(x) { error = x ; goto bad; }
- KASSERT((fibnum < rt_numfibs), ("rtrequest1_fib: bad fibnum"));
+ KASSERT((fibnum <= rt_numfibs), ("rtrequest1_fib: bad fibnum"));
if (dst->sa_family != AF_INET) /* Only INET supports > 1 fib now */
fibnum = 0;
/*
@@ -1232,7 +1232,7 @@
endfib = rt_numfibs - 1;
}
} else {
- KASSERT((fibnum < rt_numfibs), ("rtinit1: bad fibnum"));
+ KASSERT((fibnum <= rt_numfibs), ("rtinit1: bad fibnum"));
startfib = fibnum;
endfib = fibnum;
}
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200905292248.n4TMmtRN005295>