Bug 172840 - memory overwrite if configure more than 128 multicast addresses on ixgbe NIC
Summary: memory overwrite if configure more than 128 multicast addresses on ixgbe NIC
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: unspecified
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs mailing list
URL:
Keywords: IntelNetworking
Depends on:
Blocks:
 
Reported: 2012-10-18 06:20 UTC by fuzhli
Modified: 2015-08-04 16:01 UTC (History)
1 user (show)

See Also:


Attachments
file.diff (720 bytes, patch)
2012-10-18 06:20 UTC, fuzhli
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description fuzhli 2012-10-18 06:20:01 UTC
Memory will be overwrite if configure more than 128 multicast addresses on ixgbe NIC, and maybe cause system panic.

How-To-Repeat: configure more than 128 multicast addresses on ixgbe NIC
Comment 1 Sean Bruno freebsd_committer 2015-08-04 16:01:09 UTC
Because of the way that ixgbe(4) was split/deleted/readded to support if_ixv.c, its impossible to tell when this was committed to freebsd.

After a code review, this patch was applied at some point in the last few years.static void
ixgbe_set_promisc(struct adapter *adapter)
{
        u_int32_t       reg_rctl;
        struct ifnet   *ifp = adapter->ifp;
        int             mcnt = 0;

        reg_rctl = IXGBE_READ_REG(&adapter->hw, IXGBE_FCTRL);
        reg_rctl &= (~IXGBE_FCTRL_UPE);
        if (ifp->if_flags & IFF_ALLMULTI)
                mcnt = MAX_NUM_MULTICAST_ADDRESSES;
        else {  
                struct  ifmultiaddr *ifma;
#if __FreeBSD_version < 800000
                IF_ADDR_LOCK(ifp);
#else 
                if_maddr_rlock(ifp);
#endif
                TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
                        if (ifma->ifma_addr->sa_family != AF_LINK)
                                continue;
                        if (mcnt == MAX_NUM_MULTICAST_ADDRESSES)
                                break;
                        mcnt++;
                }
-------------------------- snip ------------------------------------------
static void
ixgbe_set_multi(struct adapter *adapter)
{
        u32                     fctrl;
        u8                      *update_ptr;
        struct ifmultiaddr      *ifma;
        struct ixgbe_mc_addr    *mta;
        int                     mcnt = 0;
        struct ifnet            *ifp = adapter->ifp;

        IOCTL_DEBUGOUT("ixgbe_set_multi: begin");

        mta = adapter->mta;
        bzero(mta, sizeof(*mta) * MAX_NUM_MULTICAST_ADDRESSES);

#if __FreeBSD_version < 800000
        IF_ADDR_LOCK(ifp);
#else
        if_maddr_rlock(ifp);
#endif
        TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
                if (ifma->ifma_addr->sa_family != AF_LINK)
                        continue;
                if (mcnt == MAX_NUM_MULTICAST_ADDRESSES)
                        break;
                bcopy(LLADDR((struct sockaddr_dl *) ifma->ifma_addr),
                    mta[mcnt].addr, IXGBE_ETH_LENGTH_OF_ADDRESS);
                mta[mcnt].vmdq = adapter->pool;
                mcnt++;
        }