Date: Thu, 27 Mar 2003 06:56:36 -0800 (PST) From: Maxim Konovalov <maxim@FreeBSD.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/sys/netinet ip_dummynet.c ip_dummynet.h Message-ID: <200303271456.h2REuadI063367@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
maxim 2003/03/27 06:56:36 PST
FreeBSD src repository
Modified files:
sys/netinet ip_dummynet.c ip_dummynet.h
Log:
o Protect set_fs_param() by splimp(9).
Quote from kern/37573:
There is an obvious race in netinet/ip_dummynet.c:config_pipe().
Interrupts are not blocked when changing the params of an
existing pipe. The specific crash observed:
... -> config_pipe -> set_fs_parms -> config_red
malloc a new w_q_lookup table but take an interrupt before
intializing it, interrupt handler does:
... -> dummynet_io -> red_drops
red_drops dereferences the uninitialized (zeroed) w_q_lookup
table.
o Flush accumulated credits for idle pipes.
o Flush accumulated credits when change pipe characteristics.
o Change dn_flow_queue.numbytes type to unsigned long.
Overlapping dn_flow_queue->numbytes in ready_event() leads to
numbytes becomes negative and SET_TICKS() macro returns a very
big value. heap_insert() overlaps dn_key again and inserts a
queue to a ready heap with a sched_time points to the past.
That leads to an "infinity" loop.
PR: kern/33234, kern/37573, misc/42459, kern/43133,
kern/44045, kern/48099
Submitted by: Mike Hibler <mike@cs.utah.edu> (kern/37573)
MFC after: 6 weeks
Revision Changes Path
1.62 +17 -7 src/sys/netinet/ip_dummynet.c
1.26 +1 -1 src/sys/netinet/ip_dummynet.h
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200303271456.h2REuadI063367>