kern/85320: possible depletion of kernel stack in ip_gre.c when net.isr.enable = 1

[Ming Fu]

>Number:         85320
>Category:       kern
>Synopsis:       possible depletion of kernel stack in ip_gre.c when net.isr.enable = 1
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Aug 26 15:00:23 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Ming Fu
>Release:        FreeBSD 5.x
>Organization:
Borderware Technologies Inc
>Environment:
FreeBSD home.borderware.com 5.4-RELEASE FreeBSD 5.4-RELEASE #1: Tue May 31 10:17:34 EDT 2005     fming at home.borderware.com
>Description:
      when net.isr.enable = 1 and a GRE packet gets into the ip_gre2(), its gre header is stripped and sent to netisr_dispatch() for ip_input() processing again. As the net.isr.enable is 1, the packet will be delivered to ip_input directly instead of put in the queue.

If someone create a packet consists of repeated ip and gre header,

     ip hdr : gre hdr : ip hdr : gre hdr : ......     repeat a few hundred times.
it can cause a loop around ip_gre->ip_gre2->netisr_dispatch->ip_input->ip_gre ..., and deplete the kernel stack.


>How-To-Repeat:
      send a packet with a few hundred repeated IP and GRE header to a freebsd 5.x with gre configured.
>Fix:
      Index: ip_gre.c
===================================================================
RCS file: /usr/cvsroot/freebsd/src/sys/netinet/ip_gre.c,v
retrieving revision 1.20
diff -u -r1.20 ip_gre.c
--- ip_gre.c    1 Aug 2005 08:14:21 -0000       1.20
+++ ip_gre.c    26 Aug 2005 14:40:32 -0000
@@ -223,7 +223,7 @@

        m->m_pkthdr.rcvif = GRE2IFP(sc);

-       netisr_dispatch(isr, m);
+       netisr_queue(isr, m);

        return (1);     /* packet is done, no further processing needed */
 }

>Release-Note:
>Audit-Trail:
>Unformatted: