DF-3469 / fix.diff
--- if_sl.c.orig +++ if_sl.c @@ -214,8 +214,14 @@ ifq_set_ready(&sc->sc_if.if_snd); sc->sc_fastq.ifq_maxlen = 32; + /* + * Do NOT register the raw softc as the link MIB: + * net.link.generic.ifdata.<idx>.linkspecific is + * world-readable and sizeof(struct sl_softc) bytes of + * it (embedded struct ifnet with function pointers, + * tty/buffer pointers, callout c_func pointers) would + * be disclosed to any local user. DF-3469. + */ + sc->sc_if.if_linkmib = NULL; + sc->sc_if.if_linkmiblen = 0; - sc->sc_if.if_linkmib = sc; - sc->sc_if.if_linkmiblen = sizeof *sc; callout_init_mp(&sc->sc_oftimeout); callout_init_mp(&sc->sc_katimeout); if_attach(&sc->sc_if, NULL); |