From antoine@massena-4-82-67-196-50.fbx.proxad.net  Fri Feb 25 14:00:49 2005
Return-Path: <antoine@massena-4-82-67-196-50.fbx.proxad.net>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D2F3216A4CE
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 25 Feb 2005 14:00:49 +0000 (GMT)
Received: from barton.dreadbsd.org (massena-4-82-67-196-50.fbx.proxad.net [82.67.196.50])
	by mx1.FreeBSD.org (Postfix) with ESMTP id AFA0943D5D
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 25 Feb 2005 14:00:48 +0000 (GMT)
	(envelope-from antoine@massena-4-82-67-196-50.fbx.proxad.net)
Received: from barton.dreadbsd.org (localhost [127.0.0.1])
	by barton.dreadbsd.org (8.13.3/8.13.1) with ESMTP id j1PE0lPI018984
	for <FreeBSD-gnats-submit@freebsd.org>; Fri, 25 Feb 2005 15:00:48 +0100 (CET)
	(envelope-from antoine@massena-4-82-67-196-50.fbx.proxad.net)
Received: (from antoine@localhost)
	by barton.dreadbsd.org (8.13.3/8.13.1/Submit) id j1PE0iQb018983;
	Fri, 25 Feb 2005 15:00:44 +0100 (CET)
	(envelope-from antoine)
Message-Id: <200502251400.j1PE0iQb018983@barton.dreadbsd.org>
Date: Fri, 25 Feb 2005 15:00:44 +0100 (CET)
From: Antoine Brodin <antoine.brodin@laposte.net>
Reply-To: Antoine Brodin <antoine.brodin@laposte.net>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: [patch] Potential null pointer dereference in bge(4)
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         78070
>Category:       kern
>Synopsis:       [bge] [patch] Potential null pointer dereference in bge(4)
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    glebius
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Feb 25 14:10:16 GMT 2005
>Closed-Date:    Mon Feb 13 11:04:35 GMT 2006
>Last-Modified:  Mon Feb 13 11:04:35 GMT 2006
>Originator:     Antoine Brodin
>Release:        FreeBSD 6.0-CURRENT i386
>Organization:
none
>Environment:
System: FreeBSD barton.dreadbsd.org 6.0-CURRENT FreeBSD 6.0-CURRENT #0: Thu Feb 24 14:18:22 CET 2005 antoine@barton.dreadbsd.org:/usr/obj/usr/src/sys/BARTON i386
>Description:
If malloc(9) fails line 770 of if_bge.c, the free jumbo list will have
less than BGE_JSLOTS entries. bge_free_jumbo_mem() will be called and
it will try to remove and to free BGE_JSLOTS entries. This will cause
a null pointer dereference in SLIST_REMOVE_HEAD(3) if the list is
already empty.

>How-To-Repeat:
I don't have any bge(4) NIC and I haven't find any report of this
problem. It's probably because the jumbo buffer block allocation
will fail before the entries allocation if we're low on memory.
>Fix:

Patch attached:

--- if_bge.diff begins here ---
Index: dev/bge/if_bge.c
===================================================================
RCS file: /home/ncvs/src/sys/dev/bge/if_bge.c,v
retrieving revision 1.83
diff -u -p -r1.83 if_bge.c
--- dev/bge/if_bge.c	6 Jan 2005 01:42:30 -0000	1.83
+++ dev/bge/if_bge.c	25 Feb 2005 12:01:38 -0000
@@ -788,10 +788,9 @@ static void
 bge_free_jumbo_mem(sc)
 	struct bge_softc *sc;
 {
-	int i;
 	struct bge_jpool_entry *entry;
 
-	for (i = 0; i < BGE_JSLOTS; i++) {
+	while (!SLIST_EMPTY(&sc->bge_jfree_listhead)) {
 		entry = SLIST_FIRST(&sc->bge_jfree_listhead);
 		SLIST_REMOVE_HEAD(&sc->bge_jfree_listhead, jpool_entries);
 		free(entry, M_DEVBUF);
--- if_bge.diff ends here ---


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->patched 
State-Changed-By: glebius 
State-Changed-When: Thu Dec 8 20:05:06 GMT 2005 
State-Changed-Why:  
Not applicable to HEAD now. 


Responsible-Changed-From-To: freebsd-bugs->glebius 
Responsible-Changed-By: glebius 
Responsible-Changed-When: Thu Dec 8 20:05:06 GMT 2005 
Responsible-Changed-Why:  
I'm working on bge's jumbo support. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=78070 
State-Changed-From-To: patched->closed 
State-Changed-By: glebius 
State-Changed-When: Mon Feb 13 11:04:07 UTC 2006 
State-Changed-Why:  
Fixed in RELENG_6. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=78070 
>Unformatted:
