Date: Thu, 18 Oct 2012 05:12:58 GMT From: fuzhli <fuzl@arraynetworks.com.cn> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/172840: memory overwrite if configure more than 128 multicast addresses on ixgbe NIC Message-ID: <201210180512.q9I5Cwq5087509@red.freebsd.org> Resent-Message-ID: <201210180520.q9I5K1rR009505@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 172840
>Category: kern
>Synopsis: memory overwrite if configure more than 128 multicast addresses on ixgbe NIC
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Thu Oct 18 05:20:01 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator: fuzhli
>Release: FreeBSD7.0
>Organization:
Array networks
>Environment:
FreeBSD7.0+ixgbe driver 2.3.10.
%uname -a
FreeBSD Array.arraynetworks.net 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Feb 24 10:35:36 UTC 2008 root@driscoll.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC amd64
>Description:
Memory will be overwrite if configure more than 128 multicast addresses on ixgbe NIC, and maybe cause system panic.
>How-To-Repeat:
configure more than 128 multicast addresses on ixgbe NIC
>Fix:
Index: src/sys/dev/ixgbe/ixgbe.c
===================================================================
RCS file: /home/src/sys/dev/ixgbe/ixgbe.c,v
retrieving revision 1.32.2.7
diff -u -p -r1.32.2.7 ixgbe.c
--- FreeBSD/src/sys/dev/ixgbe/ixgbe.c 29 Sep 2012 06:58:41 -0000 1.32.2.7
+++ FreeBSD/src/sys/dev/ixgbe/ixgbe.c 17 Oct 2012 10:17:33 -0000
@@ -2072,6 +2072,10 @@ ixgbe_set_multi(struct adapter *adapter)
TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
if (ifma->ifma_addr->sa_family != AF_LINK)
continue;
+ if (mcnt == MAX_NUM_MULTICAST_ADDRESSES)
+ break;
bcopy(LLADDR((struct sockaddr_dl *) ifma->ifma_addr),
&mta[mcnt * IXGBE_ETH_LENGTH_OF_ADDRESS],
IXGBE_ETH_LENGTH_OF_ADDRESS);
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201210180512.q9I5Cwq5087509>