From owner-freebsd-bugs@FreeBSD.ORG Tue Jan 18 14:40:31 2005 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7DFCA16A4D4 for ; Tue, 18 Jan 2005 14:40:31 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id B3E3D43D58 for ; Tue, 18 Jan 2005 14:40:27 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.1/8.13.1) with ESMTP id j0IEeR7R015456 for ; Tue, 18 Jan 2005 14:40:27 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.1/8.13.1/Submit) id j0IEeRI5015455; Tue, 18 Jan 2005 14:40:27 GMT (envelope-from gnats) Resent-Date: Tue, 18 Jan 2005 14:40:27 GMT Resent-Message-Id: <200501181440.j0IEeRI5015455@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Eugene Stark Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0E7D016A4CE for ; Tue, 18 Jan 2005 14:38:41 +0000 (GMT) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id CC00143D48 for ; Tue, 18 Jan 2005 14:38:40 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id j0IEce0m023352 for ; Tue, 18 Jan 2005 14:38:40 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id j0IEceum023351; Tue, 18 Jan 2005 14:38:40 GMT (envelope-from nobody) Message-Id: <200501181438.j0IEceum023351@www.freebsd.org> Date: Tue, 18 Jan 2005 14:38:40 GMT From: Eugene Stark To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Subject: kern/76410: Null pointer dereference in net/bpf.c X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jan 2005 14:40:31 -0000 >Number: 76410 >Category: kern >Synopsis: Null pointer dereference in net/bpf.c >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Jan 18 14:40:27 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Eugene Stark >Release: 4.10-RELEASE >Organization: SUNY at Stony Brook >Environment: FreeBSD laptop.starkhome.cs.sunysb.edu 4.10-RELEASE-p4 FreeBSD 4.10-RELEASE-p4 #1: Mon Jan 17 17:51:38 EST 2005 gene@laptop.starkhome.cs.sunysb.edu:/A/src/sys/compile/LAPTOP i386 >Description: After applying the patch I proposed in PR-76207 for a null pointer dereference in pci/if_xl.c, I found that it exposed a different bug in net/bpf.c. Specifically, if a call is made to bpfdetach() when no devices have been successfully attached and consequently bpf_iflist is NULL, then it is possible to exit the first loop in bpfdetach() with bp == NULL, thus causing a NULL pointer dereference in the next statement. It appears from the comments that the author wished to defend against the case in which an attempt was made to detach a device that had never successfully been attached. However, the code does not properly handle the situation in which this occurs when there are no other devices that had been attached. >How-To-Repeat: This occurred after applying the patch I suggest to pci/if_xl.c in PR-76207. Although that patch avoided a crash in the xl driver proper, the next time I saw the error it ended up taking a null pointer dereference in bpfdetach(). So to repeat the problem, one would have to attempt to bpfdetach() a device that has not been bpfattach()ed, in a situation in which no other devices are attached to BPF. The xl driver will expose this problem under certain conditions. >Fix: I have applied the following patch to net/bpf.c: *** bpf.c.orig Wed Dec 1 08:14:54 2004 --- bpf.c Mon Jan 17 17:51:12 2005 *************** *** 1440,1446 **** } /* Interface wasn't attached */ ! if (bp->bif_ifp == NULL) { splx(s); printf("bpfdetach: %s%d was not attached\n", ifp->if_name, ifp->if_unit); --- 1440,1446 ---- } /* Interface wasn't attached */ ! if (bp == NULL || bp->bif_ifp == NULL) { splx(s); printf("bpfdetach: %s%d was not attached\n", ifp->if_name, ifp->if_unit); >Release-Note: >Audit-Trail: >Unformatted: