d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

After r319722 two fields were left uninitialized when transforming a

Browse Source 
socket structure into a listening socket. This resulted in an invalid
instruction fault for all 32-bit platforms.

When INVARIANTS is set the union where the two uninitialized fields
reside gets properly zeroed. This patch ensures the two uninitialized
fields are zeroed when INVARIANTS is undefined.

For 64-bit platforms this issue was not visible because so->sol_upcall
which is uninitialized overlaps with so->so_rcv.sb_state which is
already zero during soalloc();

For 32-bit platforms this issue was visible and resulted in an invalid
instruction fault, because so->sol_upcall overlaps with
so->so_rcv.sb_sel which is always initialized to a valid data pointer
during soalloc().

Verifying the offset locations mentioned above are identical is left
as an exercise to the reader.

PR: 220452
PR: 220358
Reviewed by:	ae (network), gallatin
Differential Revision:	https://reviews.freebsd.org/D11475
Sponsored by:	Mellanox Technologies
This commit is contained in:
Hans Petter Selasky 2017-07-04 18:23:17 +00:00
parent 89ea89de85
commit fe715b8090
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=320652
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/kern/uipc_socket.c
View File

@ -858,6 +858,9 @@ solisten_proto(struct socket *so, int backlog)
so->sol_accept_filter_arg = NULL;
so->sol_accept_filter_str = NULL;
so->sol_upcall = NULL;
so->sol_upcallarg = NULL;
so->so_options |= SO_ACCEPTCONN;
listening: