From nobody@FreeBSD.org  Wed Sep  4 19:26:45 2013
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1])
	(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by hub.freebsd.org (Postfix) with ESMTP id B17BE1F9
	for <freebsd-gnats-submit@FreeBSD.org>; Wed,  4 Sep 2013 19:26:45 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from oldred.freebsd.org (oldred.freebsd.org [8.8.178.121])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mx1.freebsd.org (Postfix) with ESMTPS id 9E2622E0B
	for <freebsd-gnats-submit@FreeBSD.org>; Wed,  4 Sep 2013 19:26:45 +0000 (UTC)
Received: from oldred.freebsd.org ([127.0.1.6])
	by oldred.freebsd.org (8.14.5/8.14.7) with ESMTP id r84JQj5t060916
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 4 Sep 2013 19:26:45 GMT
	(envelope-from nobody@oldred.freebsd.org)
Received: (from nobody@localhost)
	by oldred.freebsd.org (8.14.5/8.14.5/Submit) id r84JQjYh060913;
	Wed, 4 Sep 2013 19:26:45 GMT
	(envelope-from nobody)
Message-Id: <201309041926.r84JQjYh060913@oldred.freebsd.org>
Date: Wed, 4 Sep 2013 19:26:45 GMT
From: Sven-Thorsten Dietrich <sven@inter-yacht.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: Use unsigned type when indexing into mfchashtbl
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         181821
>Category:       kern
>Synopsis:       [netinet] [patch] Use unsigned type when indexing into mfchashtbl
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    jhb
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Sep 04 19:30:00 UTC 2013
>Closed-Date:    Wed Nov 13 18:35:38 UTC 2013
>Last-Modified:  Wed Nov 13 18:40:02 UTC 2013
>Originator:     Sven-Thorsten Dietrich
>Release:        HEAD
>Organization:
Vyatta
>Environment:
>Description:
Several instances of indexing into hash table using int type.
Should always index into hash table using unsigned.
>How-To-Repeat:

>Fix:
See patch

Patch attached with submission follows:

Use unsigned type when indexing into mfchashtbl.
Eliminate rollover problems and consequent out-of-bounds indexes
for size of mfchashtbl > MAXINT.

Signed-off-by: Sven-Thorsten Dietrich <sven@vyatta.com>

Index: netinet/ip_mroute.c
===================================================================
--- netinet/ip_mroute.c	(revision 255189)
+++ netinet/ip_mroute.c	(working copy)
@@ -609,7 +608,7 @@
 if_detached_event(void *arg __unused, struct ifnet *ifp)
 {
     vifi_t vifi;
-    int i;
+    u_long i;
 
     MROUTER_LOCK();
 
@@ -705,7 +704,7 @@
 X_ip_mrouter_done(void)
 {
     vifi_t vifi;
-    int i;
+    u_long i;
     struct ifnet *ifp;
     struct ifreq ifr;
 
@@ -803,7 +802,7 @@
 int
 set_api_config(uint32_t *apival)
 {
-    int i;
+    u_long i;
 
     /*
      * We can set the API capabilities only if it is the first operation
@@ -1439,7 +1438,7 @@
 static void
 expire_upcalls(void *arg)
 {
-    int i;
+    u_long i;
 
     CURVNET_SET((struct vnet *) arg);
 


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Thu Sep 5 02:10:21 UTC 2013 
Responsible-Changed-Why:  
Over to maintainer(s). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=181821 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/181821: commit references a PR
Date: Thu,  5 Sep 2013 14:16:45 +0000 (UTC)

 Author: jhb
 Date: Thu Sep  5 14:16:37 2013
 New Revision: 255248
 URL: http://svnweb.freebsd.org/changeset/base/255248
 
 Log:
   Use an unsigned long when indexing into mfchashtbl[] and mf6ctable[].  This
   matches the types used when computing hash indices and the type of the
   maximum size of mfchashtbl[].
   
   PR:		kern/181821
   Submitted by:	Sven-Thorsten Dietrich <sven@vyatta.com> (IPv4)
   MFC after:	1 week
 
 Modified:
   head/sys/netinet/ip_mroute.c
   head/sys/netinet6/ip6_mroute.c
 
 Modified: head/sys/netinet/ip_mroute.c
 ==============================================================================
 --- head/sys/netinet/ip_mroute.c	Thu Sep  5 13:53:25 2013	(r255247)
 +++ head/sys/netinet/ip_mroute.c	Thu Sep  5 14:16:37 2013	(r255248)
 @@ -609,7 +609,7 @@ static void
  if_detached_event(void *arg __unused, struct ifnet *ifp)
  {
      vifi_t vifi;
 -    int i;
 +    u_long i;
  
      MROUTER_LOCK();
  
 @@ -705,7 +705,7 @@ static int
  X_ip_mrouter_done(void)
  {
      struct ifnet *ifp;
 -    int i;
 +    u_long i;
      vifi_t vifi;
  
      MROUTER_LOCK();
 @@ -797,7 +797,7 @@ set_assert(int i)
  int
  set_api_config(uint32_t *apival)
  {
 -    int i;
 +    u_long i;
  
      /*
       * We can set the API capabilities only if it is the first operation
 @@ -1433,7 +1433,7 @@ non_fatal:
  static void
  expire_upcalls(void *arg)
  {
 -    int i;
 +    u_long i;
  
      CURVNET_SET((struct vnet *) arg);
  
 
 Modified: head/sys/netinet6/ip6_mroute.c
 ==============================================================================
 --- head/sys/netinet6/ip6_mroute.c	Thu Sep  5 13:53:25 2013	(r255247)
 +++ head/sys/netinet6/ip6_mroute.c	Thu Sep  5 14:16:37 2013	(r255248)
 @@ -576,7 +576,7 @@ int
  X_ip6_mrouter_done(void)
  {
  	mifi_t mifi;
 -	int i;
 +	u_long i;
  	struct mf6c *rt;
  	struct rtdetq *rte;
  
 @@ -1341,7 +1341,7 @@ expire_upcalls(void *unused)
  {
  	struct rtdetq *rte;
  	struct mf6c *mfc, **nptr;
 -	int i;
 +	u_long i;
  
  	MFC6_LOCK();
  	for (i = 0; i < MF6CTBLSIZ; i++) {
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->patched 
State-Changed-By: jhb 
State-Changed-When: Thu Sep 5 14:24:14 UTC 2013 
State-Changed-Why:  
Fix committed to HEAD, thanks! 


Responsible-Changed-From-To: freebsd-net->jhb 
Responsible-Changed-By: jhb 
Responsible-Changed-When: Thu Sep 5 14:24:14 UTC 2013 
Responsible-Changed-Why:  
Fix committed to HEAD, thanks! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=181821 
State-Changed-From-To: patched->closed 
State-Changed-By: jhb 
State-Changed-When: Wed Nov 13 18:35:15 UTC 2013 
State-Changed-Why:  
Fix merged to 8 and 9. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=181821 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/181821: commit references a PR
Date: Wed, 13 Nov 2013 18:35:13 +0000 (UTC)

 Author: jhb
 Date: Wed Nov 13 18:35:06 2013
 New Revision: 258103
 URL: http://svnweb.freebsd.org/changeset/base/258103
 
 Log:
   MFC 255248:
   Use an unsigned long when indexing into mfchashtbl[] and mf6ctable[].  This
   matches the types used when computing hash indices and the type of the
   maximum size of mfchashtbl[].
   
   PR:		kern/181821
 
 Modified:
   stable/8/sys/netinet/ip_mroute.c
   stable/8/sys/netinet6/ip6_mroute.c
 Directory Properties:
   stable/8/sys/   (props changed)
   stable/8/sys/netinet/   (props changed)
   stable/8/sys/netinet6/   (props changed)
 
 Modified: stable/8/sys/netinet/ip_mroute.c
 ==============================================================================
 --- stable/8/sys/netinet/ip_mroute.c	Wed Nov 13 18:33:14 2013	(r258102)
 +++ stable/8/sys/netinet/ip_mroute.c	Wed Nov 13 18:35:06 2013	(r258103)
 @@ -610,7 +610,7 @@ static void
  if_detached_event(void *arg __unused, struct ifnet *ifp)
  {
      vifi_t vifi;
 -    int i;
 +    u_long i;
  
      MROUTER_LOCK();
  
 @@ -706,7 +706,7 @@ static int
  X_ip_mrouter_done(void)
  {
      struct ifnet *ifp;
 -    int i;
 +    u_long i;
      vifi_t vifi;
  
      MROUTER_LOCK();
 @@ -798,7 +798,7 @@ set_assert(int i)
  int
  set_api_config(uint32_t *apival)
  {
 -    int i;
 +    u_long i;
  
      /*
       * We can set the API capabilities only if it is the first operation
 @@ -1432,7 +1432,7 @@ non_fatal:
  static void
  expire_upcalls(void *arg)
  {
 -    int i;
 +    u_long i;
  
      CURVNET_SET((struct vnet *) arg);
  
 
 Modified: stable/8/sys/netinet6/ip6_mroute.c
 ==============================================================================
 --- stable/8/sys/netinet6/ip6_mroute.c	Wed Nov 13 18:33:14 2013	(r258102)
 +++ stable/8/sys/netinet6/ip6_mroute.c	Wed Nov 13 18:35:06 2013	(r258103)
 @@ -571,7 +571,7 @@ int
  X_ip6_mrouter_done(void)
  {
  	mifi_t mifi;
 -	int i;
 +	u_long i;
  	struct mf6c *rt;
  	struct rtdetq *rte;
  
 @@ -1337,7 +1337,7 @@ expire_upcalls(void *unused)
  {
  	struct rtdetq *rte;
  	struct mf6c *mfc, **nptr;
 -	int i;
 +	u_long i;
  
  	MFC6_LOCK();
  	for (i = 0; i < MF6CTBLSIZ; i++) {
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/181821: commit references a PR
Date: Wed, 13 Nov 2013 18:33:28 +0000 (UTC)

 Author: jhb
 Date: Wed Nov 13 18:33:14 2013
 New Revision: 258102
 URL: http://svnweb.freebsd.org/changeset/base/258102
 
 Log:
   MFC 255248:
   Use an unsigned long when indexing into mfchashtbl[] and mf6ctable[].  This
   matches the types used when computing hash indices and the type of the
   maximum size of mfchashtbl[].
   
   PR:		kern/181821
 
 Modified:
   stable/9/sys/netinet/ip_mroute.c
   stable/9/sys/netinet6/ip6_mroute.c
 Directory Properties:
   stable/9/sys/   (props changed)
 
 Modified: stable/9/sys/netinet/ip_mroute.c
 ==============================================================================
 --- stable/9/sys/netinet/ip_mroute.c	Wed Nov 13 17:49:07 2013	(r258101)
 +++ stable/9/sys/netinet/ip_mroute.c	Wed Nov 13 18:33:14 2013	(r258102)
 @@ -608,7 +608,7 @@ static void
  if_detached_event(void *arg __unused, struct ifnet *ifp)
  {
      vifi_t vifi;
 -    int i;
 +    u_long i;
  
      MROUTER_LOCK();
  
 @@ -704,7 +704,7 @@ static int
  X_ip_mrouter_done(void)
  {
      struct ifnet *ifp;
 -    int i;
 +    u_long i;
      vifi_t vifi;
  
      MROUTER_LOCK();
 @@ -796,7 +796,7 @@ set_assert(int i)
  int
  set_api_config(uint32_t *apival)
  {
 -    int i;
 +    u_long i;
  
      /*
       * We can set the API capabilities only if it is the first operation
 @@ -1431,7 +1431,7 @@ non_fatal:
  static void
  expire_upcalls(void *arg)
  {
 -    int i;
 +    u_long i;
  
      CURVNET_SET((struct vnet *) arg);
  
 
 Modified: stable/9/sys/netinet6/ip6_mroute.c
 ==============================================================================
 --- stable/9/sys/netinet6/ip6_mroute.c	Wed Nov 13 17:49:07 2013	(r258101)
 +++ stable/9/sys/netinet6/ip6_mroute.c	Wed Nov 13 18:33:14 2013	(r258102)
 @@ -573,7 +573,7 @@ int
  X_ip6_mrouter_done(void)
  {
  	mifi_t mifi;
 -	int i;
 +	u_long i;
  	struct mf6c *rt;
  	struct rtdetq *rte;
  
 @@ -1338,7 +1338,7 @@ expire_upcalls(void *unused)
  {
  	struct rtdetq *rte;
  	struct mf6c *mfc, **nptr;
 -	int i;
 +	u_long i;
  
  	MFC6_LOCK();
  	for (i = 0; i < MF6CTBLSIZ; i++) {
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
>Unformatted:
