Date: Tue, 15 Mar 2005 18:22:30 GMT From: LiangYi <liangyi571@hotmail.com> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/78893: Fast forward will carsh the system in 5.x. Message-ID: <200503151822.j2FIMUPs078632@www.freebsd.org> Resent-Message-ID: <200503151830.j2FIU2k8072536@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 78893
>Category: misc
>Synopsis: Fast forward will carsh the system in 5.x.
>Confidential: no
>Severity: critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Mar 15 18:30:02 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: LiangYi
>Release: 5.3
>Organization:
lingzhou network Inc
>Environment:
FreeBSD 5.3-RELEASE
>Description:
It seems there is a bug in ip_fastfwd.c which will crash the system when it runs in fast forward mode occasionally. The crash enviroment will like this:
net.inet.ip.fastforwarding = 1
Do a over MTU ping on a busy interface
>How-To-Repeat:
same as above.
>Fix:
Look at ip_fastfwd.c, function ip_fastforward, line 499. if_output will free the mbuf when it is failed. So if an error is occured 'm' will be freed, and the loop will break. Current code will free m twice which will crash the system later.
Fix:
update line 586 from:
"for (; m; m = m0) {"
to
"for (; m = m0; ) {"
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200503151822.j2FIMUPs078632>