Date: Fri, 10 Sep 2021 12:47:00 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: a37c697b8da9 - stable/12 - pf: ensure states passed to pf_free_state() are always unlinked Message-ID: <202109101247.18ACl0j0020568@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=a37c697b8da924794157b5e596bd8127204a5922 commit a37c697b8da924794157b5e596bd8127204a5922 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2021-09-03 07:36:19 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2021-09-10 12:46:04 +0000 pf: ensure states passed to pf_free_state() are always unlinked In pf_create_state() we can end up deleting the state immediately. This can happen if we fail to map the relevant addresses or fail normalization or fail to insert it into the state table. If that happens we delete the state again with pf_free_state(). However, this asserts that the state must be unlinked. It's correct to simply set the state to PFTM_UNLINKED because we've not yet linked it. Submitted by: Mateusz Guzik <mjg@FreeBSD.org> Reviewed by: scottl MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D31752 (cherry picked from commit a0c64a443e4cae67a5eea3a61a47d746866de3ee) --- sys/netpfil/pf/pf.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index a2c91d29931a..ce94c71fb49e 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -3981,6 +3981,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, if (pf_map_addr(pd->af, r, pd->src, &s->rt_addr, NULL, &sn)) { REASON_SET(&reason, PFRES_MAPFAILED); pf_src_tree_remove_state(s); + s->timeout = PFTM_UNLINKED; STATE_DEC_COUNTERS(s); pf_free_state(s); goto csfailed; @@ -4003,6 +4004,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, off, pd, th, &s->src, &s->dst)) { REASON_SET(&reason, PFRES_MEMORY); pf_src_tree_remove_state(s); + s->timeout = PFTM_UNLINKED; STATE_DEC_COUNTERS(s); pf_free_state(s); return (PF_DROP); @@ -4015,6 +4017,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, ("pf_normalize_tcp_stateful failed on first " "pkt\n")); pf_src_tree_remove_state(s); + s->timeout = PFTM_UNLINKED; STATE_DEC_COUNTERS(s); pf_free_state(s); return (PF_DROP); @@ -4042,6 +4045,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a, (pd->dir == PF_IN) ? nk : sk, s)) { REASON_SET(&reason, PFRES_STATEINS); pf_src_tree_remove_state(s); + s->timeout = PFTM_UNLINKED; STATE_DEC_COUNTERS(s); pf_free_state(s); return (PF_DROP);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202109101247.18ACl0j0020568>