kern/78070: [patch] Potential null pointer dereference in bge(4)

Antoine Brodin antoine.brodin at
Fri Feb 25 14:10:17 GMT 2005

>Number:         78070
>Category:       kern
>Synopsis:       [patch] Potential null pointer dereference in bge(4)
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Feb 25 14:10:16 GMT 2005
>Originator:     Antoine Brodin
>Release:        FreeBSD 6.0-CURRENT i386
System: FreeBSD 6.0-CURRENT FreeBSD 6.0-CURRENT #0: Thu Feb 24 14:18:22 CET 2005 antoine at i386
If malloc(9) fails line 770 of if_bge.c, the free jumbo list will have
less than BGE_JSLOTS entries. bge_free_jumbo_mem() will be called and
it will try to remove and to free BGE_JSLOTS entries. This will cause
a null pointer dereference in SLIST_REMOVE_HEAD(3) if the list is
already empty.

I don't have any bge(4) NIC and I haven't find any report of this
problem. It's probably because the jumbo buffer block allocation
will fail before the entries allocation if we're low on memory.

Patch attached:

--- if_bge.diff begins here ---
Index: dev/bge/if_bge.c
RCS file: /home/ncvs/src/sys/dev/bge/if_bge.c,v
retrieving revision 1.83
diff -u -p -r1.83 if_bge.c
--- dev/bge/if_bge.c	6 Jan 2005 01:42:30 -0000	1.83
+++ dev/bge/if_bge.c	25 Feb 2005 12:01:38 -0000
@@ -788,10 +788,9 @@ static void
 	struct bge_softc *sc;
-	int i;
 	struct bge_jpool_entry *entry;
-	for (i = 0; i < BGE_JSLOTS; i++) {
+	while (!SLIST_EMPTY(&sc->bge_jfree_listhead)) {
 		entry = SLIST_FIRST(&sc->bge_jfree_listhead);
 		SLIST_REMOVE_HEAD(&sc->bge_jfree_listhead, jpool_entries);
 		free(entry, M_DEVBUF);
--- if_bge.diff ends here ---


More information about the freebsd-bugs mailing list