From owner-freebsd-bugs@FreeBSD.ORG Tue Mar 28 10:21:57 2006 Return-Path: X-Original-To: freebsd-bugs@FreeBSD.org Delivered-To: freebsd-bugs@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AB4DE16A401; Tue, 28 Mar 2006 10:21:57 +0000 (UTC) (envelope-from trhodes@FreeBSD.org) Received: from pittgoth.com (ns1.pittgoth.com [216.38.206.188]) by mx1.FreeBSD.org (Postfix) with ESMTP id 38BE543D45; Tue, 28 Mar 2006 10:21:56 +0000 (GMT) (envelope-from trhodes@FreeBSD.org) Received: from localhost (net-ix.gw.ai.net [205.134.160.6] (may be forged)) (authenticated bits=0) by pittgoth.com (8.13.4/8.13.4) with ESMTP id k2SBIh88077713 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 28 Mar 2006 06:18:43 -0500 (EST) (envelope-from trhodes@FreeBSD.org) Date: Tue, 28 Mar 2006 05:21:50 -0500 From: Tom Rhodes To: Robert Watson Message-Id: <20060328052150.5f96e147.trhodes@FreeBSD.org> In-Reply-To: <20060328095916.A19236@fledge.watson.org> References: <20060327184013.6d60173c.zhouyi04@ios.cn> <20060328095916.A19236@fledge.watson.org> X-Mailer: Sylpheed version 1.0.5 (GTK+ 1.2.10; i386-portbld-freebsd7.0) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: gnn@FreeBSD.org, freebsd-bugs@FreeBSD.org, bz@FreeBSD.org, trustedbsd-discuss@FreeBSD.org, zhouyi04@ios.cn Subject: Re: settling serious conflicts between MAC and IPSEC X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2006 10:21:57 -0000 On Tue, 28 Mar 2006 10:02:39 +0000 (GMT) Robert Watson wrote: > > On Mon, 27 Mar 2006, zhouyi zhou wrote: > > > High everyone, there exists a serious bug in function ipsec_copypkt(m) of > > netinet6/ipsec.c in FreeBSD 5.4, FreeBSD 6.0 and FreeBSD 7.0 > > > > 3469 MGETHDR(mnew, M_DONTWAIT, MT_HEADER); > > 3470 if (mnew == NULL) > > 3471 goto fail; > > 3472 mnew->m_pkthdr = n->m_pkthdr; > > 3473 #if 0 > > 3474 /* XXX: convert to m_tag or delete? */ > > 3475 if (n->m_pkthdr.aux) { > > 3476 mnew->m_pkthdr.aux = > > 3477 m_copym(n->m_pkthdr.aux, > > 3478 0, M_COPYALL, M_DONTWAIT); > > 3479 } > > 3480 #endif > > 3481 M_MOVE_PKTHDR(mnew, n); > > > > On line 3472, mnew->m_pkthdr is assigned n->m_pkthdr, and on line 3481, in > > function m_move_pkthdr, mnew's tag list will be delete (and the n's tag of > > cause). This will cause system to crash. > > > > After commenting out line 3472, everything is OK. > > Thanks for this report! The M_MOVE_PKTHDR() should do all the necessary work, > including copying the fields referenced in 3472, as well as handling existing > m_tags right. I've attached a patch with your proposal, which looks and > sounds good to me, and CC'd George and Bjoern in the hopes that one of them > will give it a node of approval before I commit it -- hopefully we can get > this MFC'd for 6.1-RELEASE. > > Robert N M Watson > Should also close kern/94599 -- Tom Rhodes