On Wed, 29 Nov 2017 12:49:19 +0100 Hans Petter Selasky <h...@selasky.org> wrote:
> On 11/29/17 11:51, Hartmann, O. wrote: > > On Wed, 29 Nov 2017 09:40:11 +0000 (UTC) > > Hans Petter Selasky <hsela...@freebsd.org> wrote: > > > >> Author: hselasky > >> Date: Wed Nov 29 09:40:11 2017 > >> New Revision: 326362 > >> URL: https://svnweb.freebsd.org/changeset/base/326362 > >> > >> Log: > >> Disallow TUN and TAP character device IOCTLs to modify the > >> network device type to any value. This can cause page faults and > >> panics due to accessing uninitialized fields in the "struct ifnet" > >> which are specific to the network device type. > >> > >> MFC after: 1 week > >> Found by: j...@iki.fi > >> PR: 223767 > >> Sponsored by: Mellanox Technologies > >> > >> Modified: > >> head/share/man/man4/tap.4 > >> head/share/man/man4/tun.4 > >> head/sys/net/if_tap.c > >> head/sys/net/if_tun.c > >> > >> Modified: head/share/man/man4/tap.4 > >> ============================================================================== > >> --- head/share/man/man4/tap.4 Wed Nov 29 09:18:24 2017 > >> (r326361) +++ head/share/man/man4/tap.4 Wed Nov 29 09:40:11 > >> 2017 (r326362) @@ -1,7 +1,7 @@ > >> .\" $FreeBSD$ > >> .\" Based on PR#2411 > >> .\" > >> -.Dd April 10, 2015 > >> +.Dd November 29, 2017 > >> .Dt TAP 4 > >> .Os > >> .Sh NAME > >> @@ -171,7 +171,14 @@ calls are supported > >> .In net/if_tap.h ) : > >> .Bl -tag -width VMIO_SIOCSETMACADDR > >> .It Dv TAPSIFINFO > >> -Set network interface information (line speed, MTU and type). > >> +Set network interface information (line speed and MTU). > >> +The type must be the same as returned by > >> +.Dv TAPGIFINFO > >> +or set to > >> +.Dv IFT_ETHER > >> +else the > >> +.Xr ioctl 2 > >> +call will fail. > >> The argument should be a pointer to a > >> .Va struct tapinfo . > >> .It Dv TAPGIFINFO > >> > >> Modified: head/share/man/man4/tun.4 > >> ============================================================================== > >> --- head/share/man/man4/tun.4 Wed Nov 29 09:18:24 2017 > >> (r326361) +++ head/share/man/man4/tun.4 Wed Nov 29 09:40:11 > >> 2017 (r326362) @@ -2,7 +2,7 @@ > >> .\" $FreeBSD$ > >> .\" Based on PR#2411 > >> .\" > >> -.Dd November 30, 2014 > >> +.Dd November 29, 2017 > >> .Dt TUN 4 > >> .Os > >> .Sh NAME > >> @@ -208,8 +208,15 @@ this stores the internal debugging variable's > >> value in .It Dv TUNSIFINFO > >> The argument should be a pointer to an > >> .Vt struct tuninfo > >> -and allows setting the MTU, the type, and the baudrate of the > >> tunnel +and allows setting the MTU and the baudrate of the tunnel > >> device. > >> +The type must be the same as returned by > >> +.Dv TUNGIFINFO > >> +or set to > >> +.Dv IFT_PPP > >> +else the > >> +.Xr ioctl 2 > >> +call will fail. > >> The > >> .Vt struct tuninfo > >> is declared in > >> > >> Modified: head/sys/net/if_tap.c > >> ============================================================================== > >> --- head/sys/net/if_tap.c Wed Nov 29 09:18:24 2017 > >> (r326361) +++ head/sys/net/if_tap.c Wed Nov 29 09:40:11 > >> 2017 (r326362) @@ -737,9 +737,10 @@ tapioctl(struct cdev > >> *dev, u_long cmd, caddr_t data, i switch (cmd) { > >> case TAPSIFINFO: > >> tapp = (struct tapinfo *)data; > >> + if (ifp->if_type != tapp->type) > >> + return (EPROTOTYPE); > >> mtx_lock(&tp->tap_mtx); > >> ifp->if_mtu = tapp->mtu; > >> - ifp->if_type = tapp->type; > >> ifp->if_baudrate = tapp->baudrate; > >> mtx_unlock(&tp->tap_mtx); > >> break; > >> > >> Modified: head/sys/net/if_tun.c > >> ============================================================================== > >> --- head/sys/net/if_tun.c Wed Nov 29 09:18:24 2017 > >> (r326361) +++ head/sys/net/if_tun.c Wed Nov 29 09:40:11 > >> 2017 (r326362) @@ -676,9 +676,10 @@ tunioctl(struct cdev > >> *dev, u_long cmd, caddr_t data, i if (error) > >> return (error); > >> } > >> + if (TUN2IFP(tp)->if_type != tunp->type) > >> + return (EPROTOTYPE); > >> mtx_lock(&tp->tun_mtx); > >> TUN2IFP(tp)->if_mtu = tunp->mtu; > >> - TUN2IFP(tp)->if_type = tunp->type; > >> TUN2IFP(tp)->if_baudrate = tunp->baudrate; > >> mtx_unlock(&tp->tun_mtx); > >> break; > >> _______________________________________________ > >> svn-src-h...@freebsd.org mailing list > >> https://lists.freebsd.org/mailman/listinfo/svn-src-head > >> To unsubscribe, send any mail to > >> "svn-src-head-unsubscr...@freebsd.org" > > > > after updating from r325893 to r326362, FreeBSD CURRENT crashes > > while booting the kernel. I'm sorry having no further informations, > > it happens on a laptop with reduced space. > > > > At the moment, it seems that a lot of boxes running most recent > > CURRENT tend to crash spontanously. > > > > Hi, > > And you built the kernel from scratch and made sure your source tree > does not contain any .o files nor /usr/obj/* . > > --HPS Last time I did the make cleandir was when the OFED driver problem occured, that was some days ago. Useually, I build world and kernel with WITH_META_MODE set. Sinverely oh _______________________________________________ svn-src-all@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
