kern/52260: sys/net/if.c:if_detach in FreeBSD4 forgets resetting the ifindex2ifnet array

[Jinmei Tatuya]

>Number:         52260
>Category:       kern
>Synopsis:       sys/net/if.c:if_detach in FreeBSD4 forgets resetting the ifindex2ifnet array
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed May 14 21:50:05 PDT 2003
>Closed-Date:
>Last-Modified:
>Originator:     Jinmei Tatuya
>Release:        FreeBSD 4.8-RELEASE i386
>Organization:
Toshiba Corporation / the KAME Project
>Environment:
System: FreeBSD tachyon.jinmei.org 4.8-RELEASE FreeBSD 4.8-RELEASE #7: Thu May 8 22:57:19 JST 2003 jinmei at tachyon.jinmei.org:/home/jinmei/src/kame/kame/freebsd4/sys/compile/TACHYON_SCTP i386

machine: Toshiba Portege 2000
OS:FreeBSD 4.8 + KAME snap from the repository (around 20030510)
    (the bug is not specific to KAME snap, though)
>Description:
sys/net/if.c:if_detach() does not NULL-clear the corresponding ifindex2ifnet[]
entry, so if we try to reuse the interface index for a detached interface,
the kernel will refer to a dangling pointer and cause an unexpected behavior
(perhaps a crash).

FreeBSD current apparently does not have this bug.
But this is quite critical, so I believe we should fix this on the
FreeBSD-4 branch as well.
>How-To-Repeat:
I can't always reproduce the bug, but I once saw a kernel crash due to this
when I remove an IEEE 802 PCMCIA device from the laptop while running rtsold
on the wireless interface.
>Fix:
The following is a patch to FreeBSD 4.8 RELEASE to fix this.

--- if.c.orig	Thu May 15 12:58:18 2003
+++ if.c	Thu May 15 12:58:37 2003
@@ -310,6 +310,7 @@
 	/* Announce that the interface is gone. */
 	rt_ifannouncemsg(ifp, IFAN_DEPARTURE);
 
+	ifindex2ifnet[ifp->if_index] = NULL;
 	TAILQ_REMOVE(&ifnet, ifp, if_link);
 	splx(s);
 }




>Release-Note:
>Audit-Trail:
>Unformatted: