Bug 173002

Summary:

[net] data type size problem in if_spppsubr.c

Product:

Base System

Reporter:

Jens Wiatrowski <wiatro>

Component:

kern

Assignee:

freebsd-net (Nobody) <net>

Status:

Open ---

Severity:

Affects Only Me

CC:

Alexander88207, avos, zlei

Priority:

Normal

Version:

Unspecified

Hardware:

Any

OS:

Any

URL:

https://reviews.freebsd.org/D47335

Attachments:

Description	Flags
file.diff	none
if_spppsubr.c.patch	none

Description Jens Wiatrowski 2012-10-23 20:10:00 UTC

Because cmd in struct spppreq (/usr/include/net/if_sppp.h) is an int,
fuword32() should be used instead of fuword() in sys/net/if_spppsubr.c, line 5133, I think.

Fix: Apply the patch I've appended.
Or change the type of cmd in struct spppreq to unsigned long.

Patch attached with submission follows:
How-To-Repeat: Use /sbin/spppcontrol on a 64bit machine.

Comment 1 Eitan Adler freebsd_committer

2012-10-23 23:08:15 UTC

---------- Forwarded message ----------
From: Jens Wiatrowski <wiatro@gmx.net>
Date: 23 October 2012 16:40
Subject: Re: Re: kern/173002: data type size problem in if_spppsubr.c
To: Eitan Adler <lists@eitanadler.com>


        Hello Eitan,

>
>please send the output of "diff -u" (unified diff) - this makes it
>more likely someone will look at the patch
>
Attached.

        Regards

                Jens


-- 
Eitan Adler

Comment 2 Mark Linimon freebsd_committer

2012-10-30 15:10:40 UTC

Responsible Changed
From-To: freebsd-bugs->freebsd-net

Over to maintainer(s).

Comment 3 Eitan Adler freebsd_committer

2017-12-31 08:00:40 UTC

For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped

Comment 4 Andriy Voskoboinyk freebsd_committer

2019-01-26 12:48:50 UTC

I have no clue which type is right here; return PR to the net@

Comment 5 Zhenlei Huang freebsd_committer

2024-10-29 09:11:58 UTC

Actually user space `struct spppreq spr` is not explicitly zeroed [1], so `fuword() / fueword()` can read garbage into kernel space. I guess /sbin/spppcontrol will get error EINVAL occasionally on a 64bit platforms.

As this is an old report, not sure if the reporter Jens can confirm this.

1. https://cgit.freebsd.org/src/tree/sbin/spppcontrol/spppcontrol.c?h=stable/13#n63

Comment 6 Zhenlei Huang freebsd_committer

2024-10-30 07:24:55 UTC

(In reply to Zhenlei Huang from comment #5)
Proposed fix https://reviews.freebsd.org/D47335 .