Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 6 Mar 2017 23:41:23 +0000 (UTC)
From:      Kristof Provost <kp@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r314810 - head/sys/netpfil/pf
Message-ID:  <201703062341.v26NfNOX023569@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: kp
Date: Mon Mar  6 23:41:23 2017
New Revision: 314810
URL: https://svnweb.freebsd.org/changeset/base/314810

Log:
  pf: Fix a crash in low-memory situations
  
  If the call to pf_state_key_clone() in pf_get_translation() fails (i.e. there's
  no more memory for it) it frees skp. This is wrong, because skp is a
  pf_state_key **, so we need to free *skp, as is done later in the function.
  Getting it wrong means we try to free a stack variable of the calling
  pf_test_rule() function, and we panic.

Modified:
  head/sys/netpfil/pf/pf_lb.c

Modified: head/sys/netpfil/pf/pf_lb.c
==============================================================================
--- head/sys/netpfil/pf/pf_lb.c	Mon Mar  6 23:13:25 2017	(r314809)
+++ head/sys/netpfil/pf/pf_lb.c	Mon Mar  6 23:41:23 2017	(r314810)
@@ -553,7 +553,7 @@ pf_get_translation(struct pf_pdesc *pd, 
 		return (NULL);
 	*nkp = pf_state_key_clone(*skp);
 	if (*nkp == NULL) {
-		uma_zfree(V_pf_state_key_z, skp);
+		uma_zfree(V_pf_state_key_z, *skp);
 		*skp = NULL;
 		return (NULL);
 	}



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201703062341.v26NfNOX023569>