From owner-freebsd-bugs@FreeBSD.ORG Wed Oct 13 20:00:19 2010 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 96A151065670 for ; Wed, 13 Oct 2010 20:00:19 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 590488FC0C for ; Wed, 13 Oct 2010 20:00:19 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id o9DK0Jxu056437 for ; Wed, 13 Oct 2010 20:00:19 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id o9DK0J5J056418; Wed, 13 Oct 2010 20:00:19 GMT (envelope-from gnats) Resent-Date: Wed, 13 Oct 2010 20:00:19 GMT Resent-Message-Id: <201010132000.o9DK0J5J056418@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Andrew Boyer Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 56C1E106566C for ; Wed, 13 Oct 2010 19:51:52 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 45E078FC1B for ; Wed, 13 Oct 2010 19:51:52 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id o9DJpqUH045649 for ; Wed, 13 Oct 2010 19:51:52 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id o9DJpp4p045647; Wed, 13 Oct 2010 19:51:51 GMT (envelope-from nobody) Message-Id: <201010131951.o9DJpp4p045647@www.freebsd.org> Date: Wed, 13 Oct 2010 19:51:51 GMT From: Andrew Boyer To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/151435: Reference leak in ip_dooptions() X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Oct 2010 20:00:19 -0000 >Number: 151435 >Category: kern >Synopsis: Reference leak in ip_dooptions() >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Oct 13 20:00:18 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Andrew Boyer >Release: head >Organization: Avere Systems >Environment: N/A >Description: SVN 194760 changed ifa_ifwithaddr() so that it returns a reference along with the ifa. ifa_ifwithaddr_check() was added to simplify things for callers who didn't want to deal with a reference. On line 344 of sys/netinet/ip_options.c, there's a call to ifa_ifwithaddr() that does not store a return value. It looks like it should have been converted to ifa_ifwithaddr_check(). This is only an issue if packets with IPOPT_TS_PRESPEC set are received, so it's not likely been a problem for anyone. >How-To-Repeat: Unknown - found by code review. >Fix: --- sys/netinet/ip_options.c +++ sys/netinet/ip_options.c @@ -341,7 +341,7 @@ dropit: } (void)memcpy(&ipaddr.sin_addr, sin, sizeof(struct in_addr)); - if (ifa_ifwithaddr((SA)&ipaddr) == NULL) + if (ifa_ifwithaddr_check((SA)&ipaddr) == 0) continue; cp[IPOPT_OFFSET] += sizeof(struct in_addr); off += sizeof(struct in_addr); >Release-Note: >Audit-Trail: >Unformatted: