From owner-freebsd-bugs Fri Jun 30 6:40: 7 2000 Delivered-To: freebsd-bugs@freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21]) by hub.freebsd.org (Postfix) with ESMTP id C2BC537BAB2 for ; Fri, 30 Jun 2000 06:40:02 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.9.3/8.9.2) id GAA24169; Fri, 30 Jun 2000 06:40:01 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from sabre.velocet.net (sabre.velocet.net [198.96.118.66]) by hub.freebsd.org (Postfix) with ESMTP id DE02637BA55 for ; Fri, 30 Jun 2000 06:39:46 -0700 (PDT) (envelope-from dgilbert@office.tor.velocet.net) Received: from office.tor.velocet.net (trooper.velocet.net [216.126.82.226]) by sabre.velocet.net (Postfix) with ESMTP id E4A7F137F1A for ; Fri, 30 Jun 2000 09:39:41 -0400 (EDT) Received: (from dgilbert@localhost) by office.tor.velocet.net (8.9.3/8.9.3) id JAA79483; Fri, 30 Jun 2000 09:39:14 -0400 (EDT) (envelope-from dgilbert) Message-Id: <200006301339.JAA79483@office.tor.velocet.net> Date: Fri, 30 Jun 2000 09:39:14 -0400 (EDT) From: dgilbert@velocet.ca To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.2 Subject: kern/19603: Damn! who do I hit for this :). Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >Number: 19603 >Category: kern >Synopsis: 20 ethernet interfaces not compatible with option BRIDGE >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Jun 30 06:40:01 PDT 2000 >Closed-Date: >Last-Modified: >Originator: David Gilbert >Release: FreeBSD 4.0-STABLE i386 >Organization: Velocet Communications >Environment: Freebsd-4.0-STABLE as of recently, but this appears to affect all branches of the stable and CURRENT tree. >Description: With 20 dc interfaces in my machine and "option BRIDGE" in the kernel, I was crashing whenever I typed ifconfig -a... and about once a day otherwise. This was stack smashing for some reason >How-To-Repeat: option BRIDGE in a kernel and 20 interfaces (it would appear any type of ethernet interface will do) in the kernel. (I'm guessing that bridging doesn't work with vlans? sigh. would be nice). >Fix: I'm not 100% happy with this fix. The bdg_stats structure is used in: SYSCTL_STRUCT(_net_link_ether, PF_BDG, bdgstats, CTLFLAG_RD, &bdg_stats , bdg_stats, "bridge statistics"); and I'm not sure how to handle that. The most eggregarious error, however, is that BDG_MAX_PORTS was defined and the status structure was still defined with a constant 16 entries (not only that, but absolutely no bounds checking was done, *ever*). It would seem smart that this should be dynamic. I thought about that... and I just completely don't know what SYSCTL_STRUCT does ... But even if I did, it would only be half the job to allocate things here --- you really need to think about what happens when devices come or leave (leaving is fine, I suppose). Besides cardbus, we have hotswap PCI to worry about :). --- bridge.h.orig Fri Jun 30 09:24:59 2000 +++ bridge.h Fri Jun 30 09:25:13 2000 @@ -92,7 +92,7 @@ } ; struct bdg_stats { - struct bdg_port_stat s[16]; + struct bdg_port_stat s[BDG_MAX_PORTS]; } ; --- bridge.c.orig Fri Jun 30 09:24:37 2000 +++ bridge.c Fri Jun 30 09:25:13 2000 @@ -440,6 +440,9 @@ eth_addr = bdg_addresses ; printf("BRIDGE 990810, have %d interfaces\n", if_index); + if(if_index > BDG_MAX_PORTS) + panic("bdginit: too many ports, raise BDG_MAX_PORTS"); + for (i = 0 , ifp = ifnet.tqh_first ; i < if_index ; i++, ifp = ifp->if_link.tqe_next) if (ifp->if_type == IFT_ETHER) { /* ethernet ? */ >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message