On Tue, 2006-04-11 at 10:02 -0400, Peter Memishian wrote:
>  > I just wanted to point out; mac_alloc() always allocates a
>  > mac_register_t of size "sizeof (mac_register_t)", and that's compiled
>  > into the mac module.  The mac module always knows the correct size, so I
>  > don't think this would be an issue.  It's the driver that never really
>  > knows the true size of the structure.
> 
> Ah yes, my mistake.  So not to dive too deeply into old discussions, but
> let's say we later expand the mac_register_t, and someone compiles a
> driver against the new version.  They then put this new driver onto an
> older system -- what prevents the driver from trashing memory when it
> fills in the mac_register_t and writes off the end of the structure
> allocated by mac_alloc()?  By the time we discover the version number
> mismatch in mac_register(), it's too late, no?
> 

It would be too late, and bad things could happen.  I can think of two
things to say about this:

1. I don't believe that putting binaries compiled on one version of
Solaris onto an older version of Solaris is supported or guaranteed to
work in any case.

2. If this really needs to work (where "work" means not crash the
system), then we could version mac_alloc() as well so that it can simply
fail the allocation in this case.

-Seb


_______________________________________________
networking-discuss mailing list
[email protected]

Reply via email to