Date: Tue, 29 Mar 2005 20:40:35 GMT From: Anjali Kulkarni <anjali@juniper.net> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/79342: When looking for an unused port number for bind or connect, if low & high port range are equal, kernel can trap in divide by zero error Message-ID: <200503292040.j2TKeZ13029549@www.freebsd.org> Resent-Message-ID: <200503292050.j2TKo2TX091585@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 79342
>Category: kern
>Synopsis: When looking for an unused port number for bind or connect, if low & high port range are equal, kernel can trap in divide by zero error
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Mar 29 20:50:01 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: Anjali Kulkarni
>Release: 4.10
>Organization:
Juniper Networks
>Environment:
4.10-RELEASE-p2
>Description:
In src/sys/netinet/in_pcb.c, in the function in_pcbbind(), when trying to find an unused port number in the range of ports allowed to be used, there are cases to handle upper port limit > lower port limit and upper port limit < lower port limit, but no case to handle when they are equal. Consequently, if they are equal, the kernel will have a divide by zero trap when the line
*lastport = first - (arc4random() % (first - last))
OR the line
*lastport = first + (arc4random() % (last - first))
is executed, where first and last are the port ranges in which we check for an unused port number.
>How-To-Repeat:
set
net.inet.ip.portrange.first = net.inet.ip.portrange.last. (say 1024)
Now do a bind or a connect with a port number of 0.
>Fix:
In in_pcbbind(), there should be a check for the case when first & last are equal as follows:
/*
* Simple check to ensure all ports are not used up causing
* a deadlock here.
*
* We split the two cases (up and down) so that the direction
* is not being tested on each round of the loop.
*/
+ if (first == last) {
+ inp->inp_laddr.s_addr = INADDR_ANY;
+ return (EADDRNOTAVAIL);
+ } else if (first > last) {
- if (first > last) {
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200503292040.j2TKeZ13029549>