From nobody@FreeBSD.org  Fri May 29 22:48:56 2009
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 21C761065670
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 29 May 2009 22:48:56 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 107008FC15
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 29 May 2009 22:48:56 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n4TMmtEI005296
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 29 May 2009 22:48:55 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id n4TMmtRN005295;
	Fri, 29 May 2009 22:48:55 GMT
	(envelope-from nobody)
Message-Id: <200905292248.n4TMmtRN005295@www.freebsd.org>
Date: Fri, 29 May 2009 22:48:55 GMT
From: Mateusz Guzik <mjguzik@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: [patch][fib] Incorrect KASSERTs in sys/net/route.c
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         135067
>Category:       kern
>Synopsis:       [patch] [fib] Incorrect KASSERTs in sys/net/route.c
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-net
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri May 29 22:50:03 UTC 2009
>Closed-Date:    Thu Jan 21 21:14:43 UTC 2010
>Last-Modified:  Thu Jan 21 21:14:43 UTC 2010
>Originator:     Mateusz Guzik
>Release:        8.0-CURRENT
>Organization:
>Environment:
FreeBSD eternal 8.0-CURRENT FreeBSD 8.0-CURRENT #2: Fri May 29 23:33:10 CEST 2009     f@eternal:/usr/obj/usr/src/sys/ETERNAL  i386
>Description:
setfib() compares like this: uap->fibnum >= rt_numfibs
but KASSERT(fibnum < rt_numfibs) used in various places does not catch the case when fibnum == rt_numfibs. I believe it should be 'fibnum <= rt_numfibs' to match the check performed in setfib (and not read/write past rt_tables if fibnum == rt_numfibs == RT_MAXFIBS).
>How-To-Repeat:

>Fix:


Patch attached with submission follows:

--- route.c.orig	2009-05-02 07:02:28.000000000 +0200
+++ route.c	2009-05-30 00:23:45.000000000 +0200
@@ -297,7 +297,7 @@
 	int err = 0, msgtype = RTM_MISS;
 	int needlock;
 
-	KASSERT((fibnum < rt_numfibs), ("rtalloc1_fib: bad fibnum"));
+	KASSERT((fibnum <= rt_numfibs), ("rtalloc1_fib: bad fibnum"));
 	if (dst->sa_family != AF_INET)	/* Only INET supports > 1 fib now */
 		fibnum = 0;
 	rnh = V_rt_tables[fibnum][dst->sa_family];
@@ -936,7 +936,7 @@
 	struct sockaddr *ndst;
 #define senderr(x) { error = x ; goto bad; }
 
-	KASSERT((fibnum < rt_numfibs), ("rtrequest1_fib: bad fibnum"));
+	KASSERT((fibnum <= rt_numfibs), ("rtrequest1_fib: bad fibnum"));
 	if (dst->sa_family != AF_INET)	/* Only INET supports > 1 fib now */
 		fibnum = 0;
 	/*
@@ -1232,7 +1232,7 @@
 			endfib = rt_numfibs - 1;
 		}
 	} else {
-		KASSERT((fibnum < rt_numfibs), ("rtinit1: bad fibnum"));
+		KASSERT((fibnum <= rt_numfibs), ("rtinit1: bad fibnum"));
 		startfib = fibnum;
 		endfib = fibnum;
 	}


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Sat May 30 01:03:40 UTC 2009 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=135067 

From: Julian Elischer <julian@elischer.org>
To: bug-followup@FreeBSD.org, mjguzik@gmail.com
Cc:  
Subject: Re: kern/135067: [patch] [fib] Incorrect KASSERTs in sys/net/route.c
Date: Fri, 29 May 2009 18:58:48 -0700

 if you have 16 fibs then valid values are 0,1,2,.....14,15
 
 if fibnum == rt_numfibs then that is an error.
 
 thus in setfib... if uap->numfbs is 16 OR GREATER  it is and EINVAL
 
 and the kasserts in route.c need to check that fibnum is  LESS THAN
 rt_numfibs.
 
 so this looks correct to me..
 
 what makes you think there is an error?
 

From: Mateusz Guzik <mjguzik@gmail.com>
To: Julian Elischer <julian@elischer.org>
Cc: bug-followup@freebsd.org
Subject: Re: kern/135067: [patch] [fib] Incorrect KASSERTs in sys/net/route.c
Date: Sat, 30 May 2009 10:42:25 +0200

 On Sat, May 30, 2009 at 3:58 AM, Julian Elischer <julian@elischer.org> wrot=
 e:
 > if you have 16 fibs then valid values are 0,1,2,.....14,15
 >
 > if fibnum =3D=3D rt_numfibs then that is an error.
 >
 > thus in setfib... if uap->numfbs is 16 OR GREATER =A0it is and EINVAL
 >
 > and the kasserts in route.c need to check that fibnum is =A0LESS THAN
 > rt_numfibs.
 >
 
 That's correct.
 
 >
 > what makes you think there is an error?
 >
 
 I somehow misread that KASSERT as triggered only when fibnum >
 rt_numfibs. I guess it was too late at night. :) Sorry for the noise.
 
 --
 Mateusz Guzik <mjguzik at gmail.com>

From: Mateusz Guzik <mjguzik@gmail.com>
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/135067: [patch] [fib] Incorrect KASSERTs in sys/net/route.c
Date: Thu, 21 Jan 2010 21:06:09 +0000

 Hi,
 
 this PR can be closed as it originated from my mistake.
 
 Again, sorry for the noise
 --
 Mateusz Guzik
State-Changed-From-To: open->closed 
State-Changed-By: antoine 
State-Changed-When: Thu Jan 21 21:13:41 UTC 2010 
State-Changed-Why:  
Close at submitter's request. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=135067 
>Unformatted:
