d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
0dd6703d54
freebsd-skq/sys/netinet
History
mckusick 0dd6703d54 Malloc buckets of size 128 have been having their 64-byte offset 
trashed after being freed. This has caused several panics including
kern/42277 related to soft updates. Jim Kuhn tracked the problem
down to ipfw limit rule processing.  In the expiry of dynamic rules,
it is possible for an O_LIMIT_PARENT rule to be removed when it still
has live children.  When the children eventually do expire, a pointer
to the (long gone) parent is dereferenced and a count decremented.
Since this memory can, and is, allocated for other purposes (in the
case of kern/42277 an inodedep structure), chaos ensues. The offset
in question in inodedep is the offset of the 16 bit count field in
the ipfw2 ipfw_dyn_rule.

Submitted by:	Jim Kuhn <jkuhn@sandvine.com>
Reviewed by:	"Evgueni V. Gavrilov" <aquatique@rusunix.org>
Reviewed by:	Ben Pfountz <netprince@vt.edu>
MFC after:	1 week
2003-10-16 02:00:12 +00:00
..
libalias Grrr...add the Skinny alias code forgotten in the last commit. 2003-09-23 07:42:33 +00:00
accf_data.c
accf_http.c
icmp6.h nuke unused ICMPV6CTL_NAMES and KEYCTL_NAMES macros. 2003-10-07 15:14:33 +00:00
icmp_var.h
if_atm.c Locking for updates to routing table entries. Each rtentry gets a mutex 2003-10-04 03:44:50 +00:00
if_atm.h
if_ether.c Locking for updates to routing table entries. Each rtentry gets a mutex 2003-10-04 03:44:50 +00:00
if_ether.h Update netisr handling; Each SWI now registers its queue, and all queue 2003-03-04 23:19:55 +00:00
igmp_var.h
igmp.c Remove redundant initialization of rti; SLIST_FOREACH does that for 2003-08-28 22:15:05 +00:00
igmp.h
in_cksum.c
in_gif.c - fix typo in comment. 2003-10-07 17:46:18 +00:00
in_gif.h - fix typo in comment. 2003-10-07 17:46:18 +00:00
in_pcb.c Locking for updates to routing table entries. Each rtentry gets a mutex 2003-10-04 03:44:50 +00:00
in_pcb.h Add the IP_ONESBCAST option, to enable undirected IP broadcasts to be sent on 2003-08-20 14:46:40 +00:00
in_proto.c hookup ctlinput for fast ipsec versions of esp+ah protocols 2003-10-03 22:06:36 +00:00
in_rmx.c Lock ip forwarding route cache. While we're at it, remove the global 2003-10-14 19:19:12 +00:00
in_systm.h
in_var.h Move from a custom-crafted singly-linked list to the SLIST_* macros 2003-08-20 17:09:01 +00:00
in.c Back out M_* changes, per decision of the TRB. 2003-02-19 05:47:46 +00:00
in.h Add the IP_ONESBCAST option, to enable undirected IP broadcasts to be sent on 2003-08-20 14:46:40 +00:00
ip6.h add /*CONSTCOND*/ to reduce diffs against latest KAME. 2003-09-25 13:40:06 +00:00
ip_divert.c o add locking 2003-09-05 00:00:51 +00:00
ip_dummynet.c Minor fixups + add locking. 2003-09-17 00:54:04 +00:00
ip_dummynet.h place some kernel-specific data structures under #ifdef _KERNEL 2003-10-03 20:58:56 +00:00
ip_ecn.c
ip_ecn.h
ip_encap.c Remove unused variables. 2003-06-01 09:20:38 +00:00
ip_encap.h
ip_flow.c Locking for updates to routing table entries. Each rtentry gets a mutex 2003-10-04 03:44:50 +00:00
ip_flow.h add locking 2003-09-01 05:12:36 +00:00
ip_fw2.c Malloc buckets of size 128 have been having their 64-byte offset 2003-10-16 02:00:12 +00:00
ip_fw.h Allow set 31 to be used for rules other than 65535. 2003-07-15 23:07:34 +00:00
ip_gre.c Finish driving a stake through the heart of netns and the associated 2003-03-05 19:24:24 +00:00
ip_gre.h
ip_icmp.c Locking for updates to routing table entries. Each rtentry gets a mutex 2003-10-04 03:44:50 +00:00
ip_icmp.h Add comments regarding the ICMP timestamp fields. 2003-03-21 15:28:10 +00:00
ip_id.c
ip_input.c purge extraneous ';'s 2003-10-15 18:19:28 +00:00
ip_mroute.c Add locking. 2003-09-06 04:53:43 +00:00
ip_mroute.h 1. Basic PIM kernel support 2003-08-07 18:16:59 +00:00
ip_output.c Locking for updates to routing table entries. Each rtentry gets a mutex 2003-10-04 03:44:50 +00:00
ip_var.h Lock ip forwarding route cache. While we're at it, remove the global 2003-10-14 19:19:12 +00:00
ip.h Back out support for RFC3514. 2003-04-02 20:14:44 +00:00
ipprotosw.h
pim_var.h New PIM header files. 2003-08-07 18:17:43 +00:00
pim.h New PIM header files. 2003-08-07 18:17:43 +00:00
raw_ip.c shuffle code so we don't "continue" and miss a needed unlock operation 2003-09-17 21:13:16 +00:00
tcp_debug.c
tcp_debug.h
tcp_fsm.h
tcp_input.c A number of patches in the last years have created new return paths 2003-08-13 08:46:54 +00:00
tcp_output.c The tcp_trace call needs the length of the header. Unfortunately the 2003-08-13 08:50:42 +00:00
tcp_reass.c A number of patches in the last years have created new return paths 2003-08-13 08:46:54 +00:00
tcp_seq.h Unify the "send high" and "recover" variables as specified in the 2003-07-15 21:49:53 +00:00
tcp_subr.c Fix a bunch of off-by-one errors in the range checking code. 2003-09-11 21:40:21 +00:00
tcp_syncache.c Change instances of callout_init that specify MPSAFE behaviour to 2003-08-19 17:51:11 +00:00
tcp_timer.c Unify the "send high" and "recover" variables as specified in the 2003-07-15 21:49:53 +00:00
tcp_timer.h Remove a panic(); if the zone allocator can't provide more timewait 2003-03-08 22:06:20 +00:00
tcp_timewait.c Fix a bunch of off-by-one errors in the range checking code. 2003-09-11 21:40:21 +00:00
tcp_usrreq.c Remove check for t_state == TCPS_TIME_WAIT and introduce the tw structure. 2003-03-08 22:07:52 +00:00
tcp_var.h Unify the "send high" and "recover" variables as specified in the 2003-07-15 21:49:53 +00:00
tcp.h
tcpip.h
udp_usrreq.c PR: kern/56343 2003-09-03 02:19:29 +00:00
udp_var.h
udp.h