diff options
author | maxim <maxim@FreeBSD.org> | 2003-03-27 14:56:36 +0000 |
---|---|---|
committer | maxim <maxim@FreeBSD.org> | 2003-03-27 14:56:36 +0000 |
commit | 291fa269633b0a81036a3fc3ca80487f5835a320 (patch) | |
tree | 17e99cebc765c447b120002b2ebccc2bc7a9f4f6 /sys/netinet/ip_dummynet.h | |
parent | 2d56ed957aaef6ee5d66bcc7c86d7832b4658de5 (diff) | |
download | FreeBSD-src-291fa269633b0a81036a3fc3ca80487f5835a320.zip FreeBSD-src-291fa269633b0a81036a3fc3ca80487f5835a320.tar.gz |
o Protect set_fs_param() by splimp(9).
Quote from kern/37573:
There is an obvious race in netinet/ip_dummynet.c:config_pipe().
Interrupts are not blocked when changing the params of an
existing pipe. The specific crash observed:
... -> config_pipe -> set_fs_parms -> config_red
malloc a new w_q_lookup table but take an interrupt before
intializing it, interrupt handler does:
... -> dummynet_io -> red_drops
red_drops dereferences the uninitialized (zeroed) w_q_lookup
table.
o Flush accumulated credits for idle pipes.
o Flush accumulated credits when change pipe characteristics.
o Change dn_flow_queue.numbytes type to unsigned long.
Overlapping dn_flow_queue->numbytes in ready_event() leads to
numbytes becomes negative and SET_TICKS() macro returns a very
big value. heap_insert() overlaps dn_key again and inserts a
queue to a ready heap with a sched_time points to the past.
That leads to an "infinity" loop.
PR: kern/33234, kern/37573, misc/42459, kern/43133,
kern/44045, kern/48099
Submitted by: Mike Hibler <mike@cs.utah.edu> (kern/37573)
MFC after: 6 weeks
Diffstat (limited to 'sys/netinet/ip_dummynet.h')
-rw-r--r-- | sys/netinet/ip_dummynet.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/netinet/ip_dummynet.h b/sys/netinet/ip_dummynet.h index 588461e..626d698 100644 --- a/sys/netinet/ip_dummynet.h +++ b/sys/netinet/ip_dummynet.h @@ -218,7 +218,7 @@ struct dn_flow_queue { struct dn_pkt *head, *tail ; /* queue of packets */ u_int len ; u_int len_bytes ; - long numbytes ; /* credit for transmission (dynamic queues) */ + u_long numbytes ; /* credit for transmission (dynamic queues) */ u_int64_t tot_pkts ; /* statistics counters */ u_int64_t tot_bytes ; |