From owner-freebsd-bugs@FreeBSD.ORG  Wed Mar 30 04:40:06 2005
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8512E16A4CE
	for <freebsd-bugs@hub.freebsd.org>;
	Wed, 30 Mar 2005 04:40:06 +0000 (GMT)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 612CE43D54
	for <freebsd-bugs@hub.freebsd.org>;
	Wed, 30 Mar 2005 04:40:06 +0000 (GMT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j2U4e6r0066145
	for <freebsd-bugs@freefall.freebsd.org>; Wed, 30 Mar 2005 04:40:06 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j2U4e6Bm066144;
	Wed, 30 Mar 2005 04:40:06 GMT
	(envelope-from gnats)
Date: Wed, 30 Mar 2005 04:40:06 GMT
Message-Id: <200503300440.j2U4e6Bm066144@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: Maxim Konovalov <maxim@macomnet.ru>
Subject: Re: kern/79342: When looking for an unused port number for bind or
 connect, if low & high port range are equal, kernel can trap in divide by
 zero error
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: Maxim Konovalov <maxim@macomnet.ru>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Mar 2005 04:40:06 -0000

The following reply was made to PR kern/79342; it has been noted by GNATS.

From: Maxim Konovalov <maxim@macomnet.ru>
To: Anjali Kulkarni <anjali@juniper.net>
Cc: silby@freebsd.org, bug-followup@freebsd.org
Subject: Re: kern/79342: When looking for an unused port number for bind or
 connect, if low & high port range are equal, kernel can trap in divide by
 zero error
Date: Wed, 30 Mar 2005 08:37:19 +0400 (MSD)

 Hi,
 
 > >Synopsis:  When looking for an unused port number for bind or
 > >connect, if low & high port range are equal, kernel can trap in
 > >divide by zero error
 [...]
 > >Release:        4.10
 [...]
 > In src/sys/netinet/in_pcb.c, in the function in_pcbbind(), when
 > trying to find an unused port number in the range of ports allowed
 > to be used, there are cases to handle upper port limit > lower port
 > limit and upper port limit < lower port limit, but no case to handle
 > when they are equal. Consequently, if they are equal, the kernel
 > will have a divide by zero trap when the line *lastport = first -
 > (arc4random() % (first - last)) OR the line *lastport = first +
 > (arc4random() % (last - first)) is executed, where first and last
 > are the port ranges in which we check for an unused port number.
 >
 > >How-To-Repeat:
 >
 > set
 >
 > net.inet.ip.portrange.first = net.inet.ip.portrange.last. (say 1024)
 
 Just a note the bug is appeared with
 net.inet.ip.portrange.randomized=1 only.
 
 I think we need to stop doing random port allocation if last - first
 delta is ridiculous small.
 
 -- 
 Maxim Konovalov