Subject: bin/23122: racoon dumps core on exit
To: None <gnats-bugs@gnats.netbsd.org>
From: None <yamt@mwd.biglobe.ne.jp>
List: netbsd-bugs
Date: 10/10/2003 23:13:44
>Number: 23122
>Category: bin
>Synopsis: racoon dumps core on exit
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: bin-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Fri Oct 10 14:14:00 UTC 2003
>Closed-Date:
>Last-Modified:
>Originator: YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp>
>Release: NetBSD 1.6ZC
>Organization:
>Environment:
System: NetBSD kaeru 1.6ZC NetBSD 1.6ZC (build.kaeru) #199: Fri Oct 10 00:24:47 JST 2003 takashi@kaeru:/usr/home/takashi/work/kernel/build.kaeru i386
Architecture: i386
Machine: i386
>Description:
after recent changes to use sysctl to dump SAs,
racoon dumps core when there's no SAs in the kernel.
KEYCTL_DUMPSA sysctl returns ENOENT when there's no SAs.
then pfkey_dump_sadb() returns NULL
and check_flushsa() dereferences it.
>How-To-Repeat:
>Fix:
the following patch will avoid the problem.
i'm not sure if it's right fix or not, though.
it might be better to mimic a sadb_msg with ENOENT error
in either the kernel or pfkey_dump_sadb().
Index: racoon/session.c
===================================================================
RCS file: /cvs/NetBSD/src/crypto/dist/kame/racoon/session.c,v
retrieving revision 1.2
diff -u -p -r1.2 session.c
--- racoon/session.c 2003/07/12 09:37:12 1.2
+++ racoon/session.c 2003/10/10 14:10:13
@@ -329,6 +329,10 @@ check_flushsa()
int n;
buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
+ if (buf == NULL) {
+ /* XXX log? */
+ goto noent;
+ }
msg = (struct sadb_msg *)buf->v;
end = (struct sadb_msg *)(buf->v + buf->l);
@@ -371,6 +375,7 @@ check_flushsa()
return;
}
+noent:
close_session();
}
>Release-Note:
>Audit-Trail:
>Unformatted: