kern/135067: [patch][fib] Incorrect KASSERTs in sys/net/route.c

[Mateusz Guzik]

>Number:         135067
>Category:       kern
>Synopsis:       [patch][fib] Incorrect KASSERTs in sys/net/route.c
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri May 29 22:50:03 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Mateusz Guzik
>Release:        8.0-CURRENT
>Organization:
>Environment:
FreeBSD eternal 8.0-CURRENT FreeBSD 8.0-CURRENT #2: Fri May 29 23:33:10 CEST 2009     f at eternal:/usr/obj/usr/src/sys/ETERNAL  i386
>Description:
setfib() compares like this: uap->fibnum >= rt_numfibs
but KASSERT(fibnum < rt_numfibs) used in various places does not catch the case when fibnum == rt_numfibs. I believe it should be 'fibnum <= rt_numfibs' to match the check performed in setfib (and not read/write past rt_tables if fibnum == rt_numfibs == RT_MAXFIBS).
>How-To-Repeat:

>Fix:


Patch attached with submission follows:

--- route.c.orig	2009-05-02 07:02:28.000000000 +0200
+++ route.c	2009-05-30 00:23:45.000000000 +0200
@@ -297,7 +297,7 @@
 	int err = 0, msgtype = RTM_MISS;
 	int needlock;
 
-	KASSERT((fibnum < rt_numfibs), ("rtalloc1_fib: bad fibnum"));
+	KASSERT((fibnum <= rt_numfibs), ("rtalloc1_fib: bad fibnum"));
 	if (dst->sa_family != AF_INET)	/* Only INET supports > 1 fib now */
 		fibnum = 0;
 	rnh = V_rt_tables[fibnum][dst->sa_family];
@@ -936,7 +936,7 @@
 	struct sockaddr *ndst;
 #define senderr(x) { error = x ; goto bad; }
 
-	KASSERT((fibnum < rt_numfibs), ("rtrequest1_fib: bad fibnum"));
+	KASSERT((fibnum <= rt_numfibs), ("rtrequest1_fib: bad fibnum"));
 	if (dst->sa_family != AF_INET)	/* Only INET supports > 1 fib now */
 		fibnum = 0;
 	/*
@@ -1232,7 +1232,7 @@
 			endfib = rt_numfibs - 1;
 		}
 	} else {
-		KASSERT((fibnum < rt_numfibs), ("rtinit1: bad fibnum"));
+		KASSERT((fibnum <= rt_numfibs), ("rtinit1: bad fibnum"));
 		startfib = fibnum;
 		endfib = fibnum;
 	}


>Release-Note:
>Audit-Trail:
>Unformatted: