DragonFly BSD
DragonFly submit List (threaded) for 2005-01
[Date Prev][Date Next]  [Thread Prev][Thread Next]  [Date Index][Thread Index]

Re: sys/netinet6/in6_rmx.c: fix a double-free bug


From: Hiroki Sato <hrs@xxxxxxxxxx>
Date: Sat, 01 Jan 2005 08:09:09 +0900 (JST)

Jeffrey Hsu <hsu@xxxxxxxxxxx> wrote
  in <41d1cb86$0$719$415eb37d@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>:

hsu> I don't think it is a problem for our routing code to call rtrequest(RTM_DELETE) with
hsu> a NULL return route for the last parameter.  Are we talking about a recursive call
hsu> from rtfree() to rtfree() or from rtfree() back to rtrequest()?  A stack trace
hsu> showing the problem would help illustrate the problem for me.  Thanks.

 I can reproduce the system panic due to this double free.  Specifically,
 doing "sysctl net.inet6.ip6.rtexpire=0" and then "ping6 somewhere" will
 trigger it.  Probably Jinmei-san can explain the reason more precisely,
 but when rtq_reallyold == 0, rtfree() can be called twice from the
 rtrequest() in in6_clsroute() and somewhere else.

 Here is a stack trace when panic is occurred (I think this is not so
 useful though...)

#23 0xc03fbef4 in Debugger (msg=0xc046df3c "panic") at machine/cpufunc.h:68
#24 0xc0261848 in panic (fmt=0xc047a720 "rtfree: rn_flags 0x%x ")
    at /usr/src/sys/kern/kern_shutdown.c:618
#25 0xc02bb84f in rtfree (rt=0xc172add8) at /usr/src/sys/net/route.c:191
#26 0xc02eb111 in in6_pcbdetach (inp=0xcd81eb00)
    at /usr/src/sys/netinet6/in6_pcb.c:610
#27 0xc02f638c in udp6_detach (so=0xcd662bc0)
    at /usr/src/sys/netinet6/udp6_usrreq.c:684
#28 0xc0287c53 in netmsg_pru_detach (msg=0xcf337af8)
    at /usr/src/sys/kern/uipc_msg.c:494
#29 0xc02b9e75 in netmsg_service_loop (arg=0x0)
    at /usr/src/sys/net/netisr.c:200
#30 0xc0266aa0 in lwkt_create () at /usr/src/sys/kern/lwkt_thread.c:1260

 If you want other information on this problem, please let me know.  Thanks.

-- 
| Hiroki SATO

Attachment: pgp00002.pgp
Description: PGP signature



[Date Prev][Date Next]  [Thread Prev][Thread Next]  [Date Index][Thread Index]