From nobody@FreeBSD.org  Fri Aug 26 14:58:35 2005
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8C77916A41F
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 26 Aug 2005 14:58:35 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 59D0E43D45
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 26 Aug 2005 14:58:35 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id j7QEwZG1022936
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 26 Aug 2005 14:58:35 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id j7QEwZrw022935;
	Fri, 26 Aug 2005 14:58:35 GMT
	(envelope-from nobody)
Message-Id: <200508261458.j7QEwZrw022935@www.freebsd.org>
Date: Fri, 26 Aug 2005 14:58:35 GMT
From: Ming Fu <fming@borderware.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: possible depletion of kernel stack in ip_gre.c when net.isr.enable = 1
X-Send-Pr-Version: www-2.3

>Number:         85320
>Category:       kern
>Synopsis:       [gre] [patch] possible depletion of kernel stack in ip_gre.c when net.isr.enable = 1
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-net
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Aug 26 15:00:23 GMT 2005
>Closed-Date:    Fri Mar 15 23:29:00 UTC 2013
>Last-Modified:  Fri Mar 15 23:29:00 UTC 2013
>Originator:     Ming Fu
>Release:        FreeBSD 5.x
>Organization:
Borderware Technologies Inc
>Environment:
FreeBSD home.borderware.com 5.4-RELEASE FreeBSD 5.4-RELEASE #1: Tue May 31 10:17:34 EDT 2005     fming@home.borderware.com
>Description:
      when net.isr.enable = 1 and a GRE packet gets into the ip_gre2(), its gre header is stripped and sent to netisr_dispatch() for ip_input() processing again. As the net.isr.enable is 1, the packet will be delivered to ip_input directly instead of put in the queue.

If someone create a packet consists of repeated ip and gre header,

     ip hdr : gre hdr : ip hdr : gre hdr : ......     repeat a few hundred times.
it can cause a loop around ip_gre->ip_gre2->netisr_dispatch->ip_input->ip_gre ..., and deplete the kernel stack.


>How-To-Repeat:
      send a packet with a few hundred repeated IP and GRE header to a freebsd 5.x with gre configured.
>Fix:
      Index: ip_gre.c
===================================================================
RCS file: /usr/cvsroot/freebsd/src/sys/netinet/ip_gre.c,v
retrieving revision 1.20
diff -u -r1.20 ip_gre.c
--- ip_gre.c    1 Aug 2005 08:14:21 -0000       1.20
+++ ip_gre.c    26 Aug 2005 14:40:32 -0000
@@ -223,7 +223,7 @@

        m->m_pkthdr.rcvif = GRE2IFP(sc);

-       netisr_dispatch(isr, m);
+       netisr_queue(isr, m);

        return (1);     /* packet is done, no further processing needed */
 }

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->patched 
State-Changed-By: gonzo 
State-Changed-When: Fri Jul 4 20:47:05 UTC 2008 
State-Changed-Why:  
Patch committed 


Responsible-Changed-From-To: freebsd-bugs->gonzo 
Responsible-Changed-By: gonzo 
Responsible-Changed-When: Fri Jul 4 20:47:05 UTC 2008 
Responsible-Changed-Why:  
I'll take it 

http://www.freebsd.org/cgi/query-pr.cgi?pr=85320 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/85320: commit references a PR
Date: Fri,  4 Jul 2008 21:01:53 +0000 (UTC)

 gonzo       2008-07-04 21:01:30 UTC
 
   FreeBSD src repository
 
   Modified files:
     sys/netinet          ip_gre.c 
   Log:
   SVN rev 180264 on 2008-07-04 21:01:30Z by gonzo
   
   Enqueue de-capsulated packet instead of performing direct dispatch. It's
   possible to exhaust and garble stack with a packet that contains a couple
   of hundreds nested encapsulation levels.
   
   Submitted by:   Ming Fu <fming@borderware.com>
   Reviewed by:    rwatson
   PR:             kern/85320
   
   Revision  Changes    Path
   1.26      +2 -2      src/sys/netinet/ip_gre.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
Responsible-Changed-From-To: gonzo->freebsd-net 
Responsible-Changed-By: gonzo 
Responsible-Changed-When: Tue Nov 9 00:46:12 UTC 2010 
Responsible-Changed-Why:  
Over to maintainer(s) 

http://www.freebsd.org/cgi/query-pr.cgi?pr=85320 

From: Niclas Zeising <zeising@daemonic.se>
To: bug-followup@FreeBSD.org, fming@borderware.com
Cc: freebsd-net@freebsd.org
Subject: Re: kern/85320: [gre] [patch] possible depletion of kernel stack
 in ip_gre.c when net.isr.enable = 1
Date: Tue, 17 May 2011 16:32:05 +0200

 Hi!
 The issue mentioned in the PR has been fixed in 9-current and 8 (all
 versions). It can probably be merged to 7-stable as well, and/or the PR
 closed. Thanks!
 Regards!
 -- 
 Niclas
State-Changed-From-To: patched->closed 
State-Changed-By: eadler 
State-Changed-When: Fri Mar 15 23:28:59 UTC 2013 
State-Changed-Why:  
per Zeising 

http://www.freebsd.org/cgi/query-pr.cgi?pr=85320 
>Unformatted:
