Date: Tue, 13 Mar 2001 03:18:48 +0200 (EET) From: unicorn@Forest.Od.UA To: FreeBSD-gnats-submit@freebsd.org Subject: kern/25756: Patch against crash caused by use of uninitialized variable in ip_output. Message-ID: <200103130118.f2D1Imi00439@Unicorn.Forest.Od.UA>
next in thread | raw e-mail | index | archive | help
>Number: 25756
>Category: kern
>Synopsis: Patch against crash caused by use of uninitialized variable in ip_output.
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Mon Mar 12 17:20:00 PST 2001
>Closed-Date:
>Last-Modified:
>Originator: Winged Unicorn
>Release: FreeBSD 5.0-CURRENT i386
>Organization:
Valhala
>Environment:
System: FreeBSD Unicorn.Forest.Od.UA 5.0-CURRENT FreeBSD 5.0-CURRENT #6: Tue Mar 13 02:38:01 EET 2001 root@Unicorn.Forest.Od.UA:/usr/src/sys/compile/FOREST i386
DUMMYNET.
>Description:
When ip_output called within dummynet guts it takes
cooked mbuf ready to be sent. In ip_output() local variable
`struct in_ifaddr *ia' is used to evaluate outgoing i-face counters,
but left uninitialized. (see compiller worning)
In previous snaps this bug don't crash system. But
dummynet hangs sometimes for the same reason.. I guess.
>How-To-Repeat:
Send packet matches pipe rule.
>Fix:
Index: ip_output.c
===================================================================
RCS file: /home/ncvs/src/sys/netinet/ip_output.c,v
retrieving revision 1.122
diff -u -r1.122 ip_output.c
--- ip_output.c 2001/02/26 20:05:32 1.122
+++ ip_output.c 2001/03/13 00:47:03
@@ -91,6 +91,9 @@
(ntohl(a.s_addr))&0xFF);
#endif
+#define ifatoia(ifa) ((struct in_ifaddr *)(ifa))
+#define sintosa(sin) ((struct sockaddr *)(sin))
+
u_short ip_id;
static struct mbuf *ip_insertoptions __P((struct mbuf *, struct mbuf *, int *));
@@ -168,6 +171,7 @@
rule = (struct ip_fw_chain *)(m->m_data) ;
opt = NULL ;
ro = & ( ((struct dn_pkt *)m)->ro ) ;
+ ia = ifatoia(ro->ro_rt->rt_ifa);
imo = NULL ;
dst = ((struct dn_pkt *)m)->dn_dst ;
ifp = ((struct dn_pkt *)m)->ifp ;
@@ -233,8 +237,6 @@
* If routing to interface only,
* short circuit routing lookup.
*/
-#define ifatoia(ifa) ((struct in_ifaddr *)(ifa))
-#define sintosa(sin) ((struct sockaddr *)(sin))
if (flags & IP_ROUTETOIF) {
if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == 0 &&
(ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == 0) {
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200103130118.f2D1Imi00439>