cvs commit: src/sys/netinet ip_dummynet.c ip_dummynet.h

[Maxim Konovalov]

maxim       2003/03/27 06:56:36 PST

  FreeBSD src repository

  Modified files:
    sys/netinet          ip_dummynet.c ip_dummynet.h 
  Log:
  o Protect set_fs_param() by splimp(9).
  
  Quote from kern/37573:
  
          There is an obvious race in netinet/ip_dummynet.c:config_pipe().
          Interrupts are not blocked when changing the params of an
          existing pipe.  The specific crash observed:
  
          ... -> config_pipe -> set_fs_parms -> config_red
  
          malloc a new w_q_lookup table but take an interrupt before
          intializing it, interrupt handler does:
  
          ... -> dummynet_io -> red_drops
  
          red_drops dereferences the uninitialized (zeroed) w_q_lookup
          table.
  
  o Flush accumulated credits for idle pipes.
  o Flush accumulated credits when change pipe characteristics.
  o Change dn_flow_queue.numbytes type to unsigned long.
  
          Overlapping dn_flow_queue->numbytes in ready_event() leads to
          numbytes becomes negative and SET_TICKS() macro returns a very
          big value.  heap_insert() overlaps dn_key again and inserts a
          queue to a ready heap with a sched_time points to the past.
          That leads to an "infinity" loop.
  
  PR:             kern/33234, kern/37573, misc/42459, kern/43133,
                  kern/44045, kern/48099
  Submitted by:   Mike Hibler <mike at cs.utah.edu> (kern/37573)
  MFC after:      6 weeks
  
  Revision  Changes    Path
  1.62      +17 -7     src/sys/netinet/ip_dummynet.c
  1.26      +1 -1      src/sys/netinet/ip_dummynet.h