ifconfig wlan0 create causes memory corruption

Johannes Hofmann johannes.hofmann at gmx.de
Fri Aug 13 13:49:07 PDT 2010


When cloning an wlan interface with e.g
	ifconfig wlan0 create wlandev ath0
a struct ifnet is allocated via if_alloc and then passed to
ether_ifattach_bpf() which writes beyond the struct ifnet.
This is especially a problem if struct ifnet size is close to a chunk
size of the slab allocator - as it happens with the recent pf update.
This was catched by guards I added to the slab allocator.

Cheers,
Johannes







More information about the Bugs mailing list