Date: Mon, 30 Dec 2024 20:45:03 GMT From: Kristof Provost <kp@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 0fd06bd44aa0 - stable/14 - pf: fix double free in pf_state_key_attach() Message-ID: <202412302045.4BUKj3Bt020566@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/14 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=0fd06bd44aa04b4105608ba2bc5fc9d93d0ac056 commit 0fd06bd44aa04b4105608ba2bc5fc9d93d0ac056 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2024-12-11 22:27:21 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2024-12-30 20:42:57 +0000 pf: fix double free in pf_state_key_attach() In 371bd29d4b we fixed a state key leak, but unintentionally introduced a double free. We pass through the relevant code twice, first for PF_SK_WIRE, then for PF_SK_STACK. If we fail to attach on the second pass we have a more complex cleanup job, handled by pf_detach_state(). We must only free the state keys manually on the first pass, on the second one pf_detach_state() takes care of everything. Tested by: yds <yds@Necessitu.de> Fixes: 371bd29d4b22257a7e92e1e711cca3d94cfbd00d MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 01eb1261443dddcb50a3a278f1278fffdfb0d36e) --- sys/netpfil/pf/pf.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 53c4fcb492da..163eb2cedc27 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -1345,11 +1345,13 @@ keyattach: s->timeout = PFTM_UNLINKED; PF_HASHROW_UNLOCK(ih); KEYS_UNLOCK(); - uma_zfree(V_pf_state_key_z, skw); - if (skw != sks) - uma_zfree(V_pf_state_key_z, sks); - if (idx == PF_SK_STACK) + if (idx == PF_SK_WIRE) { + uma_zfree(V_pf_state_key_z, skw); + if (skw != sks) + uma_zfree(V_pf_state_key_z, sks); + } else { pf_detach_state(s); + } return (EEXIST); /* collision! */ } }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202412302045.4BUKj3Bt020566>