From owner-dev-commits-src-branches@freebsd.org Fri Sep 10 12:46:50 2021 Return-Path: Delivered-To: dev-commits-src-branches@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id E24566AC411; Fri, 10 Sep 2021 12:46:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4H5bGy66G5z3JYx; Fri, 10 Sep 2021 12:46:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A911D5210; Fri, 10 Sep 2021 12:46:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 18ACkoen020448; Fri, 10 Sep 2021 12:46:50 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 18ACko7e020447; Fri, 10 Sep 2021 12:46:50 GMT (envelope-from git) Date: Fri, 10 Sep 2021 12:46:50 GMT Message-Id: <202109101246.18ACko7e020447@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: a91573da22d2 - stable/13 - pf: ensure states passed to pf_free_state() are always unlinked MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: a91573da22d27f3525c485baa7a5e401083bc49c Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-branches@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commits to the stable branches of the FreeBSD src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Sep 2021 12:46:51 -0000 The branch stable/13 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=a91573da22d27f3525c485baa7a5e401083bc49c commit a91573da22d27f3525c485baa7a5e401083bc49c Author: Kristof Provost AuthorDate: 2021-09-03 07:36:19 +0000 Commit: Kristof Provost CommitDate: 2021-09-10 12:45:50 +0000 pf: ensure states passed to pf_free_state() are always unlinked In pf_create_state() we can end up deleting the state immediately. This can happen if we fail to map the relevant addresses or fail normalization or fail to insert it into the state table. If that happens we delete the state again with pf_free_state(). However, this asserts that the state must be unlinked. It's correct to simply set the state to PFTM_UNLINKED because we've not yet linked it. Submitted by: Mateusz Guzik Reviewed by: scottl MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31752 (cherry picked from commit a0c64a443e4cae67a5eea3a61a47d746866de3ee) --- sys/netpfil/pf/pf.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 3b239ed6c9fa..65bd49c7c635 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -3980,6 +3980,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, if (pf_map_addr(pd->af, r, pd->src, &s->rt_addr, NULL, &sn)) { REASON_SET(&reason, PFRES_MAPFAILED); pf_src_tree_remove_state(s); + s->timeout = PFTM_UNLINKED; STATE_DEC_COUNTERS(s); pf_free_state(s); goto csfailed; @@ -4002,6 +4003,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, off, pd, th, &s->src, &s->dst)) { REASON_SET(&reason, PFRES_MEMORY); pf_src_tree_remove_state(s); + s->timeout = PFTM_UNLINKED; STATE_DEC_COUNTERS(s); pf_free_state(s); return (PF_DROP); @@ -4014,6 +4016,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, ("pf_normalize_tcp_stateful failed on first " "pkt\n")); pf_src_tree_remove_state(s); + s->timeout = PFTM_UNLINKED; STATE_DEC_COUNTERS(s); pf_free_state(s); return (PF_DROP); @@ -4041,6 +4044,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, (pd->dir == PF_IN) ? nk : sk, s)) { REASON_SET(&reason, PFRES_STATEINS); pf_src_tree_remove_state(s); + s->timeout = PFTM_UNLINKED; STATE_DEC_COUNTERS(s); pf_free_state(s); return (PF_DROP);