[src/trunk]: src/sys/netinet Fix random kernel memory corruption by algo_doub...

[gson <gson%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5e9e54fe7b07
branches:  trunk
changeset: 778078:5e9e54fe7b07
user:      gson <gson%NetBSD.org@localhost>
date:      Thu Mar 15 13:25:46 2012 +0000

description:
Fix random kernel memory corruption by algo_doublehash().  And by
"random" I don't mean just "arbitary" as in using an uninitialized
pointer, but random as in corrupting the contents of memory addresses
chosen using a crypto-strength random number generator.

I believe this is the likely cause of multiple reports of random
crashes over the last six months, including kern/45677 and kern/46096.

diffstat:

 sys/netinet/rfc6056.c |  9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diffs (38 lines):

diff -r ce289a6312fe -r 5e9e54fe7b07 sys/netinet/rfc6056.c
--- a/sys/netinet/rfc6056.c     Thu Mar 15 13:23:10 2012 +0000
+++ b/sys/netinet/rfc6056.c     Thu Mar 15 13:25:46 2012 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: rfc6056.c,v 1.4 2011/11/19 22:51:25 tls Exp $  */
+/*     $NetBSD: rfc6056.c,v 1.5 2012/03/15 13:25:46 gson Exp $ */
 
 /*
  * Copyright 2011 Vlad Balan
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: rfc6056.c,v 1.4 2011/11/19 22:51:25 tls Exp $");
+__KERNEL_RCSID(0, "$NetBSD: rfc6056.c,v 1.5 2012/03/15 13:25:46 gson Exp $");
 
 #include "opt_inet.h"
 
@@ -665,8 +665,9 @@
        uint16_t count, num_ephemeral;
        uint16_t mymin, mymax, lastport;
        uint16_t *next_ephemeral;
-       uint16_t offset, idx, myport;
+       uint16_t offset, myport;
        static uint16_t dhtable[8];
+       size_t idx;
        int error;
 
        DPRINTF("%s called\n", __func__);
@@ -688,7 +689,7 @@
        /* Ephemeral port selection function */
        num_ephemeral = mymax - mymin + 1;
        offset = Fhash(inp_hdr);
-       idx = Fhash(inp_hdr);   /* G */
+       idx = Fhash(inp_hdr) % __arraycount(dhtable);   /* G */
        count = num_ephemeral;
 
        do {