PERFORCE change 194138 for review

[Takuya ASADA]

http://p4web.freebsd.org/@@194138?ac=10

Change 194138 by syuu at x200 on 2011/06/03 05:39:56

	index size check on ioctl

Affected files ...

.. //depot/projects/soc2011/mq_bpf/src/sys/net/bpf.c#4 edit
.. //depot/projects/soc2011/mq_bpf/src/sys/net/if_var.h#3 edit

Differences ...

==== //depot/projects/soc2011/mq_bpf/src/sys/net/bpf.c#4 (text+ko) ====

@@ -1614,7 +1614,13 @@
 				error = EINVAL;
 				break;
 			}
+			struct ifnet *const ifp = d->bd_bif->bif_ifp;
 			index = *(uint32_t *)addr;
+			if (index > ifp->if_rxq_num) {
+				log(LOG_DEBUG, "index too large\n");
+				error = EINVAL;
+				break;
+			}
 			log(LOG_DEBUG, "index:%d\n", index);
 			d->bd_qmask.qm_rxq_mask[index] = TRUE;
 			break;
@@ -1637,7 +1643,13 @@
 				error = EINVAL;
 				break;
 			}
+			struct ifnet *const ifp = d->bd_bif->bif_ifp;
 			index = *(uint32_t *)addr;
+			if (index > ifp->if_rxq_num) {
+				log(LOG_DEBUG, "index too large\n");
+				error = EINVAL;
+				break;
+			}
 			log(LOG_DEBUG, "index:%d\n", index);
 			d->bd_qmask.qm_rxq_mask[index] = FALSE;
 			break;
@@ -1660,7 +1672,13 @@
 				error = EINVAL;
 				break;
 			}
+			struct ifnet *const ifp = d->bd_bif->bif_ifp;
 			index = *(uint32_t *)addr;
+			if (index > ifp->if_rxq_num) {
+				log(LOG_DEBUG, "index too large\n");
+				error = EINVAL;
+				break;
+			}
 			log(LOG_DEBUG, "index:%d\n", index);
 			*(uint32_t *)addr = d->bd_qmask.qm_rxq_mask[index];
 			break;
@@ -1683,7 +1701,13 @@
 				error = EINVAL;
 				break;
 			}
+			struct ifnet *const ifp = d->bd_bif->bif_ifp;
 			index = *(uint32_t *)addr;
+			if (index > ifp->if_txq_num) {
+				log(LOG_DEBUG, "index too large\n");
+				error = EINVAL;
+				break;
+			}
 			log(LOG_DEBUG, "index:%d\n", index);
 			d->bd_qmask.qm_txq_mask[index] = TRUE;
 			break;
@@ -1706,7 +1730,13 @@
 				error = EINVAL;
 				break;
 			}
+			struct ifnet *const ifp = d->bd_bif->bif_ifp;
 			index = *(uint32_t *)addr;
+			if (index > ifp->if_txq_num) {
+				log(LOG_DEBUG, "index too large\n");
+				error = EINVAL;
+				break;
+			}
 			log(LOG_DEBUG, "index:%d\n", index);
 			d->bd_qmask.qm_txq_mask[index] = FALSE;
 			break;
@@ -1729,7 +1759,13 @@
 				error = EINVAL;
 				break;
 			}
+			struct ifnet *const ifp = d->bd_bif->bif_ifp;
 			index = *(uint32_t *)addr;
+			if (index > ifp->if_txq_num) {
+				log(LOG_DEBUG, "index too large\n");
+				error = EINVAL;
+				break;
+			}
 			log(LOG_DEBUG, "index:%d\n", index);
 			*(uint32_t *)addr = d->bd_qmask.qm_txq_mask[index];
 			break;

==== //depot/projects/soc2011/mq_bpf/src/sys/net/if_var.h#3 (text+ko) ====