From jinmei@shuttle.wide.toshiba.co.jp  Wed May 14 21:49:44 2003
Return-Path: <jinmei@shuttle.wide.toshiba.co.jp>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6132137B401
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 14 May 2003 21:49:44 -0700 (PDT)
Received: from shuttle.wide.toshiba.co.jp (shuttle.wide.toshiba.co.jp [202.249.10.124])
	by mx1.FreeBSD.org (Postfix) with ESMTP id D416D43F3F
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 14 May 2003 21:49:43 -0700 (PDT)
	(envelope-from jinmei@shuttle.wide.toshiba.co.jp)
Received: from shuttle.wide.toshiba.co.jp (localhost [::1])
	by shuttle.wide.toshiba.co.jp (Postfix) with ESMTP id BAF3015253
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 15 May 2003 13:49:42 +0900 (JST)
Received: (from jinmei@localhost)
	by shuttle.wide.toshiba.co.jp (8.12.8p1/8.12.6/Submit) id h4F4ngYL084992;
	Thu, 15 May 2003 13:49:42 +0900 (JST)
Message-Id: <200305150449.h4F4ngYL084992@shuttle.wide.toshiba.co.jp>
Date: Thu, 15 May 2003 13:49:42 +0900 (JST)
From: Jinmei Tatuya <jinmei@isl.rdc.toshiba.co.jp>
Reply-To: Jinmei Tatuya <jinmei@isl.rdc.toshiba.co.jp>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: sys/net/if.c:if_detach in FreeBSD4 forgets resetting the ifindex2ifnet array
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         52260
>Category:       kern
>Synopsis:       sys/net/if.c:if_detach in FreeBSD4 forgets resetting the ifindex2ifnet array
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    brooks
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed May 14 21:50:05 PDT 2003
>Closed-Date:    Wed Sep 08 04:08:53 GMT 2004
>Last-Modified:  Wed Sep 08 04:08:53 GMT 2004
>Originator:     Jinmei Tatuya
>Release:        FreeBSD 4.8-RELEASE i386
>Organization:
Toshiba Corporation / the KAME Project
>Environment:
System: FreeBSD tachyon.jinmei.org 4.8-RELEASE FreeBSD 4.8-RELEASE #7: Thu May 8 22:57:19 JST 2003 jinmei@tachyon.jinmei.org:/home/jinmei/src/kame/kame/freebsd4/sys/compile/TACHYON_SCTP i386

machine: Toshiba Portege 2000
OS:FreeBSD 4.8 + KAME snap from the repository (around 20030510)
    (the bug is not specific to KAME snap, though)
>Description:
sys/net/if.c:if_detach() does not NULL-clear the corresponding ifindex2ifnet[]
entry, so if we try to reuse the interface index for a detached interface,
the kernel will refer to a dangling pointer and cause an unexpected behavior
(perhaps a crash).

FreeBSD current apparently does not have this bug.
But this is quite critical, so I believe we should fix this on the
FreeBSD-4 branch as well.
>How-To-Repeat:
I can't always reproduce the bug, but I once saw a kernel crash due to this
when I remove an IEEE 802 PCMCIA device from the laptop while running rtsold
on the wireless interface.
>Fix:
The following is a patch to FreeBSD 4.8 RELEASE to fix this.

--- if.c.orig	Thu May 15 12:58:18 2003
+++ if.c	Thu May 15 12:58:37 2003
@@ -310,6 +310,7 @@
 	/* Announce that the interface is gone. */
 	rt_ifannouncemsg(ifp, IFAN_DEPARTURE);
 
+	ifindex2ifnet[ifp->if_index] = NULL;
 	TAILQ_REMOVE(&ifnet, ifp, if_link);
 	splx(s);
 }




>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: arved 
Responsible-Changed-When: Fri Aug 27 15:57:32 GMT 2004 
Responsible-Changed-Why:  
Over to freebsd-net for review 

http://www.freebsd.org/cgi/query-pr.cgi?pr=52260 
State-Changed-From-To: open->patched 
State-Changed-By: brooks 
State-Changed-When: Fri Aug 27 19:42:47 GMT 2004 
State-Changed-Why:  
I've patched 6-CURRENT and will MFC to RELENG_4 and RELENG_5 (subject 
to re@ approval) soon. 


Responsible-Changed-From-To: freebsd-net->brooks 
Responsible-Changed-By: brooks 
Responsible-Changed-When: Fri Aug 27 19:42:47 GMT 2004 
Responsible-Changed-Why:  
I've patched 6-CURRENT and will MFC to RELENG_4 and RELENG_5 (subject 
to re@ approval) soon. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=52260 
State-Changed-From-To: patched->closed 
State-Changed-By: brooks 
State-Changed-When: Wed Sep 8 04:07:45 GMT 2004 
State-Changed-Why:  
Merged to RELENG_4. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=52260 
>Unformatted:
