Date: Thu, 15 May 2003 13:49:42 +0900 (JST) From: Jinmei Tatuya <jinmei@isl.rdc.toshiba.co.jp> To: FreeBSD-gnats-submit@FreeBSD.org Subject: kern/52260: sys/net/if.c:if_detach in FreeBSD4 forgets resetting the ifindex2ifnet array Message-ID: <200305150449.h4F4ngYL084992@shuttle.wide.toshiba.co.jp> Resent-Message-ID: <200305150450.h4F4o5Z3019138@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 52260
>Category: kern
>Synopsis: sys/net/if.c:if_detach in FreeBSD4 forgets resetting the ifindex2ifnet array
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed May 14 21:50:05 PDT 2003
>Closed-Date:
>Last-Modified:
>Originator: Jinmei Tatuya
>Release: FreeBSD 4.8-RELEASE i386
>Organization:
Toshiba Corporation / the KAME Project
>Environment:
System: FreeBSD tachyon.jinmei.org 4.8-RELEASE FreeBSD 4.8-RELEASE #7: Thu May 8 22:57:19 JST 2003 jinmei@tachyon.jinmei.org:/home/jinmei/src/kame/kame/freebsd4/sys/compile/TACHYON_SCTP i386
machine: Toshiba Portege 2000
OS:FreeBSD 4.8 + KAME snap from the repository (around 20030510)
(the bug is not specific to KAME snap, though)
>Description:
sys/net/if.c:if_detach() does not NULL-clear the corresponding ifindex2ifnet[]
entry, so if we try to reuse the interface index for a detached interface,
the kernel will refer to a dangling pointer and cause an unexpected behavior
(perhaps a crash).
FreeBSD current apparently does not have this bug.
But this is quite critical, so I believe we should fix this on the
FreeBSD-4 branch as well.
>How-To-Repeat:
I can't always reproduce the bug, but I once saw a kernel crash due to this
when I remove an IEEE 802 PCMCIA device from the laptop while running rtsold
on the wireless interface.
>Fix:
The following is a patch to FreeBSD 4.8 RELEASE to fix this.
--- if.c.orig Thu May 15 12:58:18 2003
+++ if.c Thu May 15 12:58:37 2003
@@ -310,6 +310,7 @@
/* Announce that the interface is gone. */
rt_ifannouncemsg(ifp, IFAN_DEPARTURE);
+ ifindex2ifnet[ifp->if_index] = NULL;
TAILQ_REMOVE(&ifnet, ifp, if_link);
splx(s);
}
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200305150449.h4F4ngYL084992>