NetBSD Problem Report #41682
From www@NetBSD.org Wed Jul 8 06:52:36 2009
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
by www.NetBSD.org (Postfix) with ESMTP id 7D47163B913
for <gnats-bugs@gnats.netbsd.org>; Wed, 8 Jul 2009 06:52:36 +0000 (UTC)
Message-Id: <20090708065236.3C84063B883@www.NetBSD.org>
Date: Wed, 8 Jul 2009 06:52:36 +0000 (UTC)
From: tmcintos@eskimo.com
Reply-To: tmcintos@eskimo.com
To: gnats-bugs@NetBSD.org
Subject: dhcpcd Segmentation Fault on NetBSD/sgimips 5.0 (patch included)
X-Send-Pr-Version: www-1.0
>Number: 41682
>Category: bin
>Synopsis: dhcpcd Segmentation Fault on NetBSD/sgimips 5.0 (patch included)
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: bin-bug-people
>State: closed
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Wed Jul 08 06:55:00 +0000 2009
>Closed-Date: Mon Nov 23 09:17:36 +0000 2009
>Last-Modified: Mon Nov 23 09:17:36 +0000 2009
>Originator: Timothy McIntosh
>Release: NetBSD/sgimips 5.0
>Organization:
Green Dome Software
>Environment:
NetBSD hoth.astro.net 5.0 NetBSD 5.0 (GENERIC32_IP2x) #0: Mon Apr 27 06:08:08 UTC 2009 builds@b1.netbsd.org:/home/builds/ab/netbsd-5-0-RELEASE/sgimips/200904260229Z-obj/home/builds/ab/netbsd-5-0-RELEASE/src/sys/arch/sgimips/compile/GENERIC32_IP2x sgimips
>Description:
The command /sbin/dhcpcd/dhcpcd -n -B -E sq1 crashes with a segmentation fault.
The problem is caused by passing an IPv4 address (in_addr_t) from an instance of 'struct in_addr' to the function dhcp.c:get_option_addr() as type (uint32_t). In NetBSD, struct in_addr is defined as a packed structure. The result is that an instance of struct in_addr may not be aligned to a 32-bit address boundary, which is what happens with the variable 'net' in dhcp.c:configure_env() on sgimips at -O2. Since get_option_addr() is declared to take a (presumably aligned) pointer to uint32_t, at -O2 the memcpy() in get_option_addr() at dhcp.c:336 is replaced with a simple store word instruction. This results in a SIGSEGV (presumably due to an alignment exception) when this function is called from configure_env() at dhcp.c:1234.
Reference:
http://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Type-Attributes.html#Type-Attributes
>How-To-Repeat:
% /sbin/dhcpcd/dhcpcd -n -B -E sq1
sq1: dhcpcd 4.0.10 starting
sq1: broadcasting for a lease
sq1: offered [...] from [...]
sq1: acknowledged [...] from [...]
sq1: checking [...] is available on attached networks
sq1: leased [...] for 341521 seconds
Segmentation fault
%
>Fix:
The function get_option_addr() in dhcp.c should be changed to accept a pointer to 'struct in_addr' rather than a pointer to uint32_t. All calls to this function must be adjusted accordingly. The attached patch fixes the problem on my system.
Index: dist/client.c
===================================================================
RCS file: /cvsroot/src/external/bsd/dhcpcd/dist/Attic/client.c,v
retrieving revision 1.1.1.2.6.2
diff -u -r1.1.1.2.6.2 client.c
--- dist/client.c 6 Feb 2009 02:25:38 -0000 1.1.1.2.6.2
+++ dist/client.c 8 Jul 2009 06:41:36 -0000
@@ -368,7 +368,7 @@
return;
lease->addr.s_addr = dhcp->yiaddr;
- if (get_option_addr(&lease->net.s_addr, dhcp, DHO_SUBNETMASK) == -1)
+ if (get_option_addr(&lease->net, dhcp, DHO_SUBNETMASK) == -1)
lease->net.s_addr = get_netmask(dhcp->yiaddr);
if (get_option_uint32(&lease->leasetime, dhcp, DHO_LEASETIME) == 0) {
/* Ensure that we can use the lease */
@@ -1346,7 +1346,7 @@
addr.s_addr = dhcp->yiaddr;
a = xstrdup(inet_ntoa(addr));
}
- r = get_option_addr(&addr.s_addr, dhcp, DHO_SERVERID);
+ r = get_option_addr(&addr, dhcp, DHO_SERVERID);
if (dhcp->servername[0] && r == 0)
logger(lvl, "%s %s from %s `%s'", msg, a,
inet_ntoa(addr), dhcp->servername);
@@ -1382,7 +1382,7 @@
* We should expand this to check IP and/or hardware address
* at the packet level. */
if (options->blacklist_len != 0 &&
- get_option_addr(&addr.s_addr, dhcp, DHO_SERVERID) == 0)
+ get_option_addr(&addr, dhcp, DHO_SERVERID) == 0)
{
for (i = 0; i < options->blacklist_len; i++) {
if (options->blacklist[i] != addr.s_addr)
@@ -1434,7 +1434,7 @@
if (type == DHCP_OFFER && state->state == STATE_DISCOVERING) {
lease->addr.s_addr = dhcp->yiaddr;
- get_option_addr(&lease->server.s_addr, dhcp, DHO_SERVERID);
+ get_option_addr(&lease->server, dhcp, DHO_SERVERID);
log_dhcp(LOG_INFO, "offered", dhcp);
if (state->options & DHCPCD_TEST) {
run_script(options, iface->name, "TEST", dhcp, NULL);
@@ -1467,7 +1467,7 @@
case STATE_RENEWING:
case STATE_REBINDING:
if (!(state->options & DHCPCD_INFORM)) {
- get_option_addr(&lease->server.s_addr,
+ get_option_addr(&lease->server,
dhcp, DHO_SERVERID);
log_dhcp(LOG_INFO, "acknowledged", dhcp);
}
Index: dist/configure.c
===================================================================
RCS file: /cvsroot/src/external/bsd/dhcpcd/dist/configure.c,v
retrieving revision 1.1.1.2.6.1
diff -u -r1.1.1.2.6.1 configure.c
--- dist/configure.c 9 Jan 2009 03:13:49 -0000 1.1.1.2.6.1
+++ dist/configure.c 8 Jul 2009 06:41:37 -0000
@@ -357,9 +357,9 @@
if (addr.s_addr == 0)
addr.s_addr = lease->addr.s_addr;
/* Ensure we have all the needed values */
- if (get_option_addr(&net.s_addr, dhcp, DHO_SUBNETMASK) == -1)
+ if (get_option_addr(&net, dhcp, DHO_SUBNETMASK) == -1)
net.s_addr = get_netmask(addr.s_addr);
- if (get_option_addr(&brd.s_addr, dhcp, DHO_BROADCAST) == -1)
+ if (get_option_addr(&brd, dhcp, DHO_BROADCAST) == -1)
brd.s_addr = addr.s_addr | ~net.s_addr;
}
Index: dist/dhcp.c
===================================================================
RCS file: /cvsroot/src/external/bsd/dhcpcd/dist/dhcp.c,v
retrieving revision 1.1.1.2.6.2
diff -u -r1.1.1.2.6.2 dhcp.c
--- dist/dhcp.c 6 Feb 2009 02:25:38 -0000 1.1.1.2.6.2
+++ dist/dhcp.c 8 Jul 2009 06:41:37 -0000
@@ -327,25 +327,25 @@
}
int
-get_option_addr(uint32_t *a, const struct dhcp_message *dhcp, uint8_t option)
+get_option_addr(struct in_addr *a, const struct dhcp_message *dhcp, uint8_t option)
{
const uint8_t *p = get_option_raw(dhcp, option);
if (!p)
return -1;
- memcpy(a, p, sizeof(*a));
+ memcpy(&a->s_addr, p, sizeof(*a));
return 0;
}
int
get_option_uint32(uint32_t *i, const struct dhcp_message *dhcp, uint8_t option)
{
- uint32_t a;
+ struct in_addr a;
if (get_option_addr(&a, dhcp, option) == -1)
return -1;
- *i = ntohl(a);
+ *i = ntohl(a.s_addr);
return 0;
}
@@ -1231,14 +1231,14 @@
* message but are not necessarily in the options */
addr.s_addr = dhcp->yiaddr;
setvar(&ep, prefix, "ip_address", inet_ntoa(addr));
- if (get_option_addr(&net.s_addr, dhcp, DHO_SUBNETMASK) == -1) {
+ if (get_option_addr(&net, dhcp, DHO_SUBNETMASK) == -1) {
net.s_addr = get_netmask(addr.s_addr);
setvar(&ep, prefix, "subnet_mask", inet_ntoa(net));
}
i = inet_ntocidr(net);
snprintf(cidr, sizeof(cidr), "%d", inet_ntocidr(net));
setvar(&ep, prefix, "subnet_cidr", cidr);
- if (get_option_addr(&brd.s_addr, dhcp, DHO_BROADCAST) == -1) {
+ if (get_option_addr(&brd, dhcp, DHO_BROADCAST) == -1) {
brd.s_addr = addr.s_addr | ~net.s_addr;
setvar(&ep, prefix, "broadcast_address", inet_ntoa(brd));
}
Index: dist/dhcp.h
===================================================================
RCS file: /cvsroot/src/external/bsd/dhcpcd/dist/dhcp.h,v
retrieving revision 1.1.1.2
diff -u -r1.1.1.2 dhcp.h
--- dist/dhcp.h 19 Sep 2008 22:59:58 -0000 1.1.1.2
+++ dist/dhcp.h 8 Jul 2009 06:41:37 -0000
@@ -160,7 +160,7 @@
int make_option_mask(uint8_t *, char **, int);
void print_options(void);
char *get_option_string(const struct dhcp_message *, uint8_t);
-int get_option_addr(uint32_t *, const struct dhcp_message *, uint8_t);
+int get_option_addr(struct in_addr *, const struct dhcp_message *, uint8_t);
int get_option_uint32(uint32_t *, const struct dhcp_message *, uint8_t);
int get_option_uint16(uint16_t *, const struct dhcp_message *, uint8_t);
int get_option_uint8(uint8_t *, const struct dhcp_message *, uint8_t);
>Release-Note:
>Audit-Trail:
From: Roy Marples <roy@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/41682 CVS commit: src/external/bsd/dhcpcd/dist
Date: Wed, 8 Jul 2009 22:33:29 +0000
Module Name: src
Committed By: roy
Date: Wed Jul 8 22:33:29 UTC 2009
Update of /cvsroot/src/external/bsd/dhcpcd/dist
In directory ivanova.netbsd.org:/tmp/cvs-serv20839
Log Message:
Update to dhcpcd-5.0.6
Changes from dhcpcd-5.0.5 include
* Fix crash on MIPS, fixes PR bin/41682
Thanks to Tim McIntosh <tmcintos@eskimo.com> for the patch
* Save and restore interface MTU when changing
* IP whitelist
* Ensure that the lease and pidfile directories exist at startup
Status:
Vendor Tag: roy
Release Tags: dhcpcd-5-0-6
U src/external/bsd/dhcpcd/dist/net.h
U src/external/bsd/dhcpcd/dist/net.c
U src/external/bsd/dhcpcd/dist/ipv4ll.h
U src/external/bsd/dhcpcd/dist/ipv4ll.c
U src/external/bsd/dhcpcd/dist/if-pref.h
U src/external/bsd/dhcpcd/dist/if-pref.c
U src/external/bsd/dhcpcd/dist/if-options.h
U src/external/bsd/dhcpcd/dist/if-options.c
U src/external/bsd/dhcpcd/dist/if-bsd.c
U src/external/bsd/dhcpcd/dist/eloop.h
U src/external/bsd/dhcpcd/dist/eloop.c
U src/external/bsd/dhcpcd/dist/duid.h
U src/external/bsd/dhcpcd/dist/duid.c
U src/external/bsd/dhcpcd/dist/dhcpcd.h
U src/external/bsd/dhcpcd/dist/dhcpcd.conf.5.in
U src/external/bsd/dhcpcd/dist/dhcpcd.conf
U src/external/bsd/dhcpcd/dist/dhcpcd.c
U src/external/bsd/dhcpcd/dist/dhcpcd.8.in
U src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.in
U src/external/bsd/dhcpcd/dist/dhcpcd-run-hooks.8.in
U src/external/bsd/dhcpcd/dist/dhcp.h
U src/external/bsd/dhcpcd/dist/dhcp.c
U src/external/bsd/dhcpcd/dist/control.h
U src/external/bsd/dhcpcd/dist/control.c
U src/external/bsd/dhcpcd/dist/configure.h
U src/external/bsd/dhcpcd/dist/configure.c
U src/external/bsd/dhcpcd/dist/config.h
U src/external/bsd/dhcpcd/dist/common.h
U src/external/bsd/dhcpcd/dist/common.c
U src/external/bsd/dhcpcd/dist/bpf.c
U src/external/bsd/dhcpcd/dist/bpf-filter.h
U src/external/bsd/dhcpcd/dist/bind.h
U src/external/bsd/dhcpcd/dist/bind.c
U src/external/bsd/dhcpcd/dist/arp.h
U src/external/bsd/dhcpcd/dist/arp.c
U src/external/bsd/dhcpcd/dist/README
U src/external/bsd/dhcpcd/dist/signals.h
U src/external/bsd/dhcpcd/dist/signals.c
U src/external/bsd/dhcpcd/dist/dhcpcd-hooks/10-mtu
U src/external/bsd/dhcpcd/dist/dhcpcd-hooks/20-resolv.conf
U src/external/bsd/dhcpcd/dist/dhcpcd-hooks/29-lookup-hostname
U src/external/bsd/dhcpcd/dist/dhcpcd-hooks/30-hostname
U src/external/bsd/dhcpcd/dist/dhcpcd-hooks/50-ntp.conf
U src/external/bsd/dhcpcd/dist/dhcpcd-hooks/01-test
No conflicts created by this import
State-Changed-From-To: open->feedback
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Sat, 25 Jul 2009 05:04:52 +0000
State-Changed-Why:
Is this fixed? (And should something be pulled up to -5?)
From: Tim McIntosh <tkmcintosh@gmail.com>
To: dholland@NetBSD.org
Cc: gnats-admin@NetBSD.org,
netbsd-bugs@NetBSD.org,
gnats-bugs@NetBSD.org
Subject: Re: bin/41682 (dhcpcd Segmentation Fault on NetBSD/sgimips 5.0 (patch included))
Date: Sun, 26 Jul 2009 23:47:03 -0500
Roy's patch fixed the issue for me on 5.0. He said he would try to
get this pulled up to NetBSD-5.
Thanks,
Tim
On Jul 25, 2009, at 12:04 AM, dholland@NetBSD.org wrote:
> Synopsis: dhcpcd Segmentation Fault on NetBSD/sgimips 5.0 (patch
> included)
>
> State-Changed-From-To: open->feedback
> State-Changed-By: dholland@NetBSD.org
> State-Changed-When: Sat, 25 Jul 2009 05:04:52 +0000
> State-Changed-Why:
> Is this fixed? (And should something be pulled up to -5?)
State-Changed-From-To: feedback->analyzed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Mon, 27 Jul 2009 14:55:45 +0000
State-Changed-Why:
pullups to -5 needed.
State-Changed-From-To: analyzed->closed
State-Changed-By: roy@NetBSD.org
State-Changed-When: Mon, 23 Nov 2009 09:17:36 +0000
State-Changed-Why:
dhcpcd-5.1.3 was pulled up to netbsd-5 which includes the patch here.
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.39 2013/11/01 18:47:49 spz Exp $
$NetBSD: gnats_config.sh,v 1.8 2006/05/07 09:23:38 tsutsui Exp $
Copyright © 1994-2007
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home