Bug 173002 - [net] data type size problem in if_spppsubr.c
Summary: [net] data type size problem in if_spppsubr.c
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-net (Nobody)
URL: https://reviews.freebsd.org/D47335
Keywords:
Depends on:
Blocks:
 
Reported: 2012-10-23 20:10 UTC by Jens Wiatrowski
Modified: 2024-10-30 07:24 UTC (History)
3 users (show)

See Also:

Attachments
file.diff (504 bytes, patch)
2012-10-23 20:10 UTC, Jens Wiatrowski 		no flags Details | Diff
if_spppsubr.c.patch (365 bytes, patch)
2012-10-23 23:08 UTC, Eitan Adler 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jens Wiatrowski 2012-10-23 20:10:00 UTC 
Because cmd in struct spppreq (/usr/include/net/if_sppp.h) is an int,
fuword32() should be used instead of fuword() in sys/net/if_spppsubr.c, line 5133, I think.

Fix: Apply the patch I've appended.
Or change the type of cmd in struct spppreq to unsigned long.

Patch attached with submission follows:
How-To-Repeat: Use /sbin/spppcontrol on a 64bit machine.
Comment 1 Eitan Adler freebsd_committer freebsd_triage 2012-10-23 23:08:15 UTC 
---------- Forwarded message ----------
From: Jens Wiatrowski <wiatro@gmx.net>
Date: 23 October 2012 16:40
Subject: Re: Re: kern/173002: data type size problem in if_spppsubr.c
To: Eitan Adler <lists@eitanadler.com>


        Hello Eitan,

>
>please send the output of "diff -u" (unified diff) - this makes it
>more likely someone will look at the patch
>
Attached.

        Regards

                Jens


-- 
Eitan Adler
Comment 2 Mark Linimon freebsd_committer freebsd_triage 2012-10-30 15:10:40 UTC 
Responsible Changed
From-To: freebsd-bugs->freebsd-net

Over to maintainer(s).
Comment 3 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 08:00:40 UTC 
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped
Comment 4 Andriy Voskoboinyk freebsd_committer freebsd_triage 2019-01-26 12:48:50 UTC 
I have no clue which type is right here; return PR to the net@
Comment 5 Zhenlei Huang freebsd_committer freebsd_triage 2024-10-29 09:11:58 UTC 
Actually user space `struct spppreq spr` is not explicitly zeroed [1], so `fuword() / fueword()` can read garbage into kernel space. I guess /sbin/spppcontrol will get error EINVAL occasionally on a 64bit platforms.

As this is an old report, not sure if the reporter Jens can confirm this.

1. https://cgit.freebsd.org/src/tree/sbin/spppcontrol/spppcontrol.c?h=stable/13#n63
Comment 6 Zhenlei Huang freebsd_committer freebsd_triage 2024-10-30 07:24:55 UTC 
(In reply to Zhenlei Huang from comment #5)
Proposed fix https://reviews.freebsd.org/D47335 .