DragonFlyBSD

:When cloning an wlan interface with e.g
: ifconfig wlan0 create wlandev ath0
:a struct ifnet is allocated via if_alloc and then passed to
:ether_ifattach_bpf() which writes beyond the struct ifnet.
:This is especially a problem if struct ifnet size is close to a chunk
:size of the slab allocator - as it happens with the recent pf update.
:This was catched by guards I added to the slab allocator.
:
:Cheers,
:Johannes

Ok, we need to track this down. I don't see anything in
ether_ifattach_bpf() itself that indexes past the end of the
ifnet, is it something ether_ifattach_bpf() calls or something
after ether_ifattach_bpf() returns? How much code do we have to
review here?

-Matt
Matthew Dillon
<dillon@backplane.com>

Matthew Dillon <dillon@apollo.backplane.com> wrote:
>
> :When cloning an wlan interface with e.g
> : ifconfig wlan0 create wlandev ath0
> :a struct ifnet is allocated via if_alloc and then passed to
> :ether_ifattach_bpf() which writes beyond the struct ifnet.
> :This is especially a problem if struct ifnet size is close to a chunk
> :size of the slab allocator - as it happens with the recent pf update.
> :This was catched by guards I added to the slab allocator.
> :
> :Cheers,
> :Johannes
>
> Ok, we need to track this down. I don't see anything in
> ether_ifattach_bpf() itself that indexes past the end of the
> ifnet, is it something ether_ifattach_bpf() calls or something
> after ether_ifattach_bpf() returns? How much code do we have to
> review here?

It's the bcopy() in ether_ifattach_bpf() with the XXX in the comment.
ifp is expected to be embedded in a struct arpcom, which is not the
case for the cloned wlan interface.

Cheers,
Johannes

:It's the bcopy() in ether_ifattach_bpf() with the XXX in the comment.
:ifp is expected to be embedded in a struct arpcom, which is not the
:case for the cloned wlan interface.
:
:Cheers,
:Johannes

Ok, what I will do is adopt the changes FreeBSD made which is
to hang arpcom off of a pointer in the ifp instead of embedding
the ifnet in the arpcom.

-Matt
Matthew Dillon
<dillon@backplane.com>

Urk. Let me take that back. For the moment I'll change the wlan
code to declare an arpcom, then I'll take a look at how easy it
would be to convert all of our arpcoms to if_l2com.

-Matt

Has this been addressed yet?

Regards,
Alex

"Alex Hornung \(via DragonFly issue tracker\)" <sinknull@leaf.dragonflybsd.org> wrote:
>
> Alex Hornung <ahornung@gmail.com> added the comment:
>
> Has this been addressed yet?

Yes, there is a "temporary hack" that fixes it:
7e39593549a460369e7be716ca160d20932105fd