ifconfig wlan0 create causes memory corruption
Johannes Hofmann
johannes.hofmann at gmx.de
Fri Aug 13 13:49:07 PDT 2010
When cloning an wlan interface with e.g
ifconfig wlan0 create wlandev ath0
a struct ifnet is allocated via if_alloc and then passed to
ether_ifattach_bpf() which writes beyond the struct ifnet.
This is especially a problem if struct ifnet size is close to a chunk
size of the slab allocator - as it happens with the recent pf update.
This was catched by guards I added to the slab allocator.
Cheers,
Johannes
More information about the Bugs
mailing list