Subject: bin/23122: racoon dumps core on exit
To: None <>
From: None <>
List: netbsd-bugs
Date: 10/10/2003 23:13:44
>Number:         23122
>Category:       bin
>Synopsis:       racoon dumps core on exit
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 10 14:14:00 UTC 2003
>Originator:     YAMAMOTO Takashi <>
>Release:        NetBSD 1.6ZC

System: NetBSD kaeru 1.6ZC NetBSD 1.6ZC (build.kaeru) #199: Fri Oct 10 00:24:47 JST 2003 takashi@kaeru:/usr/home/takashi/work/kernel/build.kaeru i386
Architecture: i386
Machine: i386
	after recent changes to use sysctl to dump SAs,
	racoon dumps core when there's no SAs in the kernel.

	KEYCTL_DUMPSA sysctl returns ENOENT when there's no SAs.
	then pfkey_dump_sadb() returns NULL
	and check_flushsa() dereferences it.

	the following patch will avoid the problem.
	i'm not sure if it's right fix or not, though.

	it might be better to mimic a sadb_msg with ENOENT error
	in either the kernel or pfkey_dump_sadb().

Index: racoon/session.c
RCS file: /cvs/NetBSD/src/crypto/dist/kame/racoon/session.c,v
retrieving revision 1.2
diff -u -p -r1.2 session.c
--- racoon/session.c	2003/07/12 09:37:12	1.2
+++ racoon/session.c	2003/10/10 14:10:13
@@ -329,6 +329,10 @@ check_flushsa()
 	int n;
 	buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
+	if (buf == NULL) {
+		/* XXX log? */
+		goto noent;
+	}
 	msg = (struct sadb_msg *)buf->v;
 	end = (struct sadb_msg *)(buf->v + buf->l);
@@ -371,6 +375,7 @@ check_flushsa()