Date: Fri, 25 Feb 2005 15:00:44 +0100 (CET) From: Antoine Brodin <antoine.brodin@laposte.net> To: FreeBSD-gnats-submit@FreeBSD.org Subject: kern/78070: [patch] Potential null pointer dereference in bge(4) Message-ID: <200502251400.j1PE0iQb018983@barton.dreadbsd.org> Resent-Message-ID: <200502251410.j1PEAG2i075264@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 78070 >Category: kern >Synopsis: [patch] Potential null pointer dereference in bge(4) >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Feb 25 14:10:16 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Antoine Brodin >Release: FreeBSD 6.0-CURRENT i386 >Organization: none >Environment: System: FreeBSD barton.dreadbsd.org 6.0-CURRENT FreeBSD 6.0-CURRENT #0: Thu Feb 24 14:18:22 CET 2005 antoine@barton.dreadbsd.org:/usr/obj/usr/src/sys/BARTON i386 >Description: If malloc(9) fails line 770 of if_bge.c, the free jumbo list will have less than BGE_JSLOTS entries. bge_free_jumbo_mem() will be called and it will try to remove and to free BGE_JSLOTS entries. This will cause a null pointer dereference in SLIST_REMOVE_HEAD(3) if the list is already empty. >How-To-Repeat: I don't have any bge(4) NIC and I haven't find any report of this problem. It's probably because the jumbo buffer block allocation will fail before the entries allocation if we're low on memory. >Fix: Patch attached: --- if_bge.diff begins here --- Index: dev/bge/if_bge.c =================================================================== RCS file: /home/ncvs/src/sys/dev/bge/if_bge.c,v retrieving revision 1.83 diff -u -p -r1.83 if_bge.c --- dev/bge/if_bge.c 6 Jan 2005 01:42:30 -0000 1.83 +++ dev/bge/if_bge.c 25 Feb 2005 12:01:38 -0000 @@ -788,10 +788,9 @@ static void bge_free_jumbo_mem(sc) struct bge_softc *sc; { - int i; struct bge_jpool_entry *entry; - for (i = 0; i < BGE_JSLOTS; i++) { + while (!SLIST_EMPTY(&sc->bge_jfree_listhead)) { entry = SLIST_FIRST(&sc->bge_jfree_listhead); SLIST_REMOVE_HEAD(&sc->bge_jfree_listhead, jpool_entries); free(entry, M_DEVBUF); --- if_bge.diff ends here --- >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200502251400.j1PE0iQb018983>