Re: (analysis) Re: ipv6 causing panic?
Ok, I think I found the problem but more eyes would not hurt.
netinet/in_gif.c/in_gif_input() is using:
gifp = (struct ifnet *)encap_getarg(m);
...
But encap_getarg() does this:
void *
encap_getarg(m)
struct mbuf *m;
{
void *p = NULL;
struct m_tag *tag;
tag = m_tag_find(m, PACKET_TAG_ENCAP, NULL);
if (tag != NULL) {
p = (void *)(tag + 1);
m_tag_delete(m, tag);
}
return p;
}
As far as I can tell, encap_getarg() is returning a pointer to
data that it has already free()'d. I think it has to return
*(void **)(tag+ 1) rather then (void *)(tag + 1).
Peter and Simon, please try the patch enclosed below.
-Matt
Matthew Dillon
<dillon@backplane.com>
Index: netinet/ip_encap.c
===================================================================
RCS file: /cvs/src/sys/netinet/ip_encap.c,v
retrieving revision 1.10
diff -u -r1.10 ip_encap.c
--- netinet/ip_encap.c 6 Jan 2005 09:14:13 -0000 1.10
+++ netinet/ip_encap.c 31 Jan 2005 19:54:13 -0000
@@ -512,7 +512,7 @@
tag = m_tag_find(m, PACKET_TAG_ENCAP, NULL);
if (tag != NULL) {
- p = (void *)(tag + 1);
+ p = *(void **)(tag + 1);
m_tag_delete(m, tag);
}
return p;
討論串 (同標題文章)
完整討論串 (本文為第 6 之 8 篇)：