cvs commit: src/sys/net if_gif.c

[Ruslan Ermilov]

On Mon, Mar 22, 2004 at 06:24:26AM -0800, Robert Watson wrote:
> rwatson     2004/03/22 06:24:26 PST
> 
>   FreeBSD src repository
> 
>   Modified files:
>     sys/net              if_gif.c 
>   Log:
>   Move "called", a static function variable used to detect recursive
>   processing with gif interfaces, to a global variable named "gif_called".
>   Add an annotation that this approach will not work with a reentrant
>   network stack, and that we should instead use packet tags to detect
>   excessive recursive processing.
>   
>   Revision  Changes    Path
>   1.42      +11 -4     src/sys/net/if_gif.c
> 
Implemented this in the attached patch.  Note when testing: setting
net.link.gif.max_nesting too high (>20 on my system) and triggering
the recursion causes the kernel stack exhaustion.


Cheers,
-- 
Ruslan Ermilov
ru at FreeBSD.org
FreeBSD committer
-------------- next part --------------
Index: if_gif.c
===================================================================
RCS file: /home/ncvs/src/sys/net/if_gif.c,v
retrieving revision 1.43
diff -u -p -r1.43 if_gif.c
--- if_gif.c	22 Mar 2004 15:43:14 -0000	1.43
+++ if_gif.c	30 Mar 2004 21:57:42 -0000
@@ -84,22 +84,13 @@
 #define GIFNAME		"gif"
 
 /*
- * gif_mtx protects the global gif_softc_list, and access to gif_called.
- * XXX: See comment blow on gif_called.
+ * gif_mtx protects the global gif_softc_list.
  * XXX: Per-softc locking is still required.
  */
 static struct mtx gif_mtx;
 static MALLOC_DEFINE(M_GIF, "gif", "Generic Tunnel Interface");
 static LIST_HEAD(, gif_softc) gif_softc_list;
 
-/*
- * XXX: gif_called is a recursion counter to prevent misconfiguration to
- * cause unbounded looping in the network stack.  However, this is a flawed
- * approach as it assumes non-reentrance in the stack.  This should be
- * changed to use packet tags to track recusion..
- */
-static int gif_called = 0;
-
 void	(*ng_gif_input_p)(struct ifnet *ifp, struct mbuf **mp, int af);
 void	(*ng_gif_input_orphan_p)(struct ifnet *ifp, struct mbuf *m, int af);
 void	(*ng_gif_attach_p)(struct ifnet *ifp);
@@ -347,6 +338,7 @@ gif_output(ifp, m, dst, rt)
 	struct rtentry *rt;	/* added in net2 */
 {
 	struct gif_softc *sc = (struct gif_softc*)ifp;
+	struct m_tag *mtag;
 	int error = 0;
 
 #ifdef MAC
@@ -360,21 +352,26 @@ gif_output(ifp, m, dst, rt)
 	/*
 	 * gif may cause infinite recursion calls when misconfigured.
 	 * We'll prevent this by introducing upper limit.
-	 * XXX: this mechanism may introduce another problem about
-	 *      mutual exclusion of the variable CALLED, especially if we
-	 *      use kernel thread.
 	 */
-	mtx_lock(&gif_mtx);
-	if (++gif_called > max_gif_nesting) {
-		mtx_unlock(&gif_mtx);
+	mtag = m_tag_locate(m, MTAG_GIF, MTAG_GIF_CALLED, NULL);
+	if (mtag == NULL) {
+		mtag = m_tag_alloc(MTAG_GIF, MTAG_GIF_CALLED,
+		    sizeof(int), M_NOWAIT);
+		if (mtag == NULL) {
+			m_freem(m);
+			error = ENOMEM;
+			goto end;
+		}
+		*(int *)(mtag + 1) = 0;
+		m_tag_prepend(m, mtag);
+	} else if (++*(int *)(mtag + 1) > max_gif_nesting) {
 		log(LOG_NOTICE,
 		    "gif_output: recursively called too many times(%d)\n",
-		    gif_called);
+		    *(int *)(mtag + 1));
 		m_freem(m);
 		error = EIO;	/* is there better errno? */
 		goto end;
 	}
-	mtx_unlock(&gif_mtx);
 
 	m->m_flags &= ~(M_BCAST|M_MCAST);
 	if (!(ifp->if_flags & IFF_UP) ||
@@ -414,9 +411,6 @@ gif_output(ifp, m, dst, rt)
 	}
 
   end:
-	mtx_lock(&gif_mtx);
-	gif_called = 0;		/* reset recursion counter */
-	mtx_unlock(&gif_mtx);
 	if (error)
 		ifp->if_oerrors++;
 	return error;
Index: if_gif.h
===================================================================
RCS file: /home/ncvs/src/sys/net/if_gif.h,v
retrieving revision 1.14
diff -u -p -r1.14 if_gif.h
--- if_gif.h	16 Oct 2002 19:49:37 -0000	1.14
+++ if_gif.h	30 Mar 2004 20:49:31 -0000
@@ -81,6 +81,9 @@ struct gif_softc {
 #define	GIF_MTU_MIN	(1280)	/* Minimum MTU */
 #define	GIF_MTU_MAX	(8192)	/* Maximum MTU */
 
+#define	MTAG_GIF	1080679712
+#define	MTAG_GIF_CALLED	0
+
 /* Prototypes */
 void gifattach0(struct gif_softc *);
 void gif_input(struct mbuf *, int, struct ifnet *);
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/cvs-src/attachments/20040331/d41b7288/attachment.bin