6592155 dhcpagent segmentation fault due to memory corruption
authorcarlsonj
Tue, 29 Apr 2008 09:06:08 -0700
changeset 6508 5aa21ca83cd2
parent 6507 e9fe7cad0646
child 6509 66665723ee6a
6592155 dhcpagent segmentation fault due to memory corruption
usr/src/cmd/cmd-inet/sbin/dhcpagent/agent.c
usr/src/cmd/cmd-inet/sbin/dhcpagent/states.c
usr/src/cmd/cmd-inet/sbin/dhcpagent/states.h
--- a/usr/src/cmd/cmd-inet/sbin/dhcpagent/agent.c	Tue Apr 29 01:43:08 2008 -0700
+++ b/usr/src/cmd/cmd-inet/sbin/dhcpagent/agent.c	Tue Apr 29 09:06:08 2008 -0700
@@ -19,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -696,6 +696,9 @@
 	switch (iap->ia_cmd) {
 
 	case DHCP_DROP:
+		if (dsmp->dsm_droprelease)
+			break;
+		dsmp->dsm_droprelease = B_TRUE;
 		(void) script_start(dsmp, isv6 ? EVENT_DROP6 : EVENT_DROP,
 		    dhcp_drop, NULL, NULL);
 		break;		/* not an immediate function */
@@ -898,6 +901,9 @@
 		break;
 
 	case DHCP_RELEASE:
+		if (dsmp->dsm_droprelease)
+			break;
+		dsmp->dsm_droprelease = B_TRUE;
 		(void) script_start(dsmp, isv6 ? EVENT_RELEASE6 :
 		    EVENT_RELEASE, dhcp_release, "Finished with lease.", NULL);
 		break;		/* not an immediate function */
@@ -1336,6 +1342,13 @@
 		oldstate = dsmp->dsm_state;
 
 		/*
+		 * Ignore state machines that are currently processing drop or
+		 * release; there is nothing more we can do for them.
+		 */
+		if (dsmp->dsm_droprelease)
+			continue;
+
+		/*
 		 * Look for link up/down notifications.  These occur on a
 		 * physical interface basis.
 		 */
@@ -1376,8 +1389,9 @@
 		    (!isv6 && !verify_lif(dsmp->dsm_lif))) {
 			if (dsmp->dsm_script_pid != -1)
 				script_stop(dsmp);
-			(void) script_start(dsmp, EVENT_DROP6, dhcp_drop, NULL,
-			    NULL);
+			dsmp->dsm_droprelease = B_TRUE;
+			(void) script_start(dsmp, isv6 ? EVENT_DROP6 :
+			    EVENT_DROP, dhcp_drop, NULL, NULL);
 			continue;
 		}
 
--- a/usr/src/cmd/cmd-inet/sbin/dhcpagent/states.c	Tue Apr 29 01:43:08 2008 -0700
+++ b/usr/src/cmd/cmd-inet/sbin/dhcpagent/states.c	Tue Apr 29 09:06:08 2008 -0700
@@ -19,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  *
  * This module contains core functions for managing DHCP state machine
@@ -1205,25 +1205,17 @@
 		for (dsmp = next_smach(NULL, isv6); dsmp != NULL;
 		    dsmp = dsmp_next) {
 			int	status;
-			const char *drop = isv6 ? EVENT_DROP6 : EVENT_DROP;
-			const char *release = isv6 ? EVENT_RELEASE6 :
-			    EVENT_RELEASE;
 
 			dsmp_next = next_smach(dsmp, isv6);
 
+			/* If we're already dropping or releasing, skip */
+			if (dsmp->dsm_droprelease)
+				continue;
+			dsmp->dsm_droprelease = B_TRUE;
+
 			cancel_smach_timers(dsmp);
-			if (dsmp->dsm_script_pid != -1) {
-				/*
-				 * Stop a script if it is not for DROP or
-				 * RELEASE
-				 */
-				if (strcmp(dsmp->dsm_script_event, drop) == 0 ||
-				    strcmp(dsmp->dsm_script_event, release) ==
-				    0) {
-					continue;
-				}
+			if (dsmp->dsm_script_pid != -1)
 				script_stop(dsmp);
-			}
 
 			/*
 			 * If the script is started by script_start, dhcp_drop
@@ -1232,14 +1224,16 @@
 			 */
 			if (df_get_bool(dsmp->dsm_name, isv6,
 			    DF_RELEASE_ON_SIGTERM)) {
-				if (script_start(dsmp, release, dhcp_release,
-				    "DHCP agent is exiting", &status) == 1) {
+				if (script_start(dsmp, isv6 ? EVENT_RELEASE6 :
+				    EVENT_RELEASE, dhcp_release,
+				    "DHCP agent is exiting", &status)) {
 					continue;
 				}
 				if (status == 1)
 					continue;
 			}
-			(void) script_start(dsmp, drop, dhcp_drop, NULL, NULL);
+			(void) script_start(dsmp, isv6 ? EVENT_DROP6 :
+			    EVENT_DROP, dhcp_drop, NULL, NULL);
 		}
 		if (isv6)
 			break;
--- a/usr/src/cmd/cmd-inet/sbin/dhcpagent/states.h	Tue Apr 29 01:43:08 2008 -0700
+++ b/usr/src/cmd/cmd-inet/sbin/dhcpagent/states.h	Tue Apr 29 09:06:08 2008 -0700
@@ -19,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -94,6 +94,7 @@
 	 */
 
 	DHCPSTATE	dsm_state;
+	boolean_t	dsm_droprelease;  /* soon to call finished_smach */
 
 	uint16_t	dsm_dflags;	/* DHCP_IF_* (shared with IPC) */