From nobody Mon Jul 28 15:43:01 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4brN6F2fvJz63CG9; Mon, 28 Jul 2025 15:43:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4brN6F1x81z3TSb; Mon, 28 Jul 2025 15:43:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1753717381; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Rj4ydEljvx6BWHBC4esn9qIGT9g0K6xgyUKzsDjd42w=; b=Cbs2/bk00fqUPrjrg67jP75+Vc05I1nus/AHphUuZ3ku8VDJ14K2MWcW959qVlZWiYBUMG 8Wrd4QG6zip5y9Hr0FNxYvFxjlJr96t3kE6IcC80mzBZsstYz+4Kn9C+ZJwwR+bYSOJhl+ sTYx2sgMoc4JkePK53OBtdTf0PrwlnrHIrpWvAsoKEUmNyEQ6eaY8XXBGjnXpLZV/UobCD gh+O61iikM3GP+1F3qUm4tjgSHNOizK3mY/+NJKICT2qAt/ryvo2rsYVw7gVCTWG9rLqEc 4zuzGI+ZofbfXIN5r6PaACiX6n37MdXuDZhBA/UoFSmezRIAUZSh1s1fiaVupw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1753717381; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Rj4ydEljvx6BWHBC4esn9qIGT9g0K6xgyUKzsDjd42w=; b=uGO8IUC9gecrvYkTc3yZjGEvXhP24Fol9Rk+JbEzsrYti8JCo54aZJa3QsPkgx6Pi3ufYN o9/mmoRLck0AQE6HV38wvWqdIhpsqO7hKNd3xNbJz7KyPdSmRYomBJwMUxIAK3p+0DAI1m XMjVGU+qrAzLXKicdIE8mguWmyaBOtklleNKhBFDVkqAecFeKKWMlIXH3ZOpgpO6HzEekD aScuhbaCoMlWLbo2oUy5ql6zZFWOaYfs6BWyS8AdrFn74hqcb7NhpNtUjelXL9un8LJtFI 47cpKH2itNeMpD5HnJVEKqj52R88KwW25M8nHJ/4FKnqky/yaAyXd9wNQjrO7g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1753717381; a=rsa-sha256; cv=none; b=MXBheLy2UFYDP1TiG+ZD4JqmCjjKUfiESa928bmAsdEP5hJoagtb68o2IpnzXaOwCxQEEk hNTOpe+YvRaX1AJ9j+gtXUhOLUGBmwxcT/no30lfRf2iFFzDgRMX9OLa310bBONQH5QSTs qyTiO2pfh63kdU1iNmkQBCrhPT3RIPsYNmHF5dvfHVStsVk3KRaVYlEIpEFM/llFCdQGEA sqL1F2UeGjBUibJpuXEwT/+uQAp/fmVs1rdXrJKRDtBxvS6MZEmZaA3a5QJu2sibPndQ6M zIDqOZcniW7w8Ctb4E4zISSteEHjWLhfuHu2Q89+Mkn+0U5X54opv23LwUcS/A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4brN6F1P6Qzs49; Mon, 28 Jul 2025 15:43:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 56SFh1et032194; Mon, 28 Jul 2025 15:43:01 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 56SFh1NX032191; Mon, 28 Jul 2025 15:43:01 GMT (envelope-from git) Date: Mon, 28 Jul 2025 15:43:01 GMT Message-Id: <202507281543.56SFh1NX032191@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 6efe8e6be413 - main - pf: Fix a lock leak in pf_ioctl_addrule() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 6efe8e6be4135643d8283fcb6773da641326f427 Auto-Submitted: auto-generated The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6efe8e6be4135643d8283fcb6773da641326f427 commit 6efe8e6be4135643d8283fcb6773da641326f427 Author: Mark Johnston AuthorDate: 2025-07-27 13:23:22 +0000 Commit: Mark Johnston CommitDate: 2025-07-28 15:40:20 +0000 pf: Fix a lock leak in pf_ioctl_addrule() The ERROUT macro assumes that the rules lock is held, but some error paths arise before that lock is acquired. Introduce ERROUT_UNLOCKED for that case. Reviewed by: kp Reported by: syzkaller Fixes: cc68decda316 ("pf: Reject rules with invalid port ranges") Differential Revision: https://reviews.freebsd.org/D51571 --- sys/amd64/conf/SYZKALLER | 5 +++++ sys/netpfil/pf/pf_ioctl.c | 16 ++++++++-------- 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/sys/amd64/conf/SYZKALLER b/sys/amd64/conf/SYZKALLER new file mode 100644 index 000000000000..49059302793b --- /dev/null +++ b/sys/amd64/conf/SYZKALLER @@ -0,0 +1,5 @@ +include GENERIC +ident SYZKALLER + +options COVERAGE +options KCOV diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index ea9f7fe441c6..9abc07c36788 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2092,19 +2092,18 @@ pf_ioctl_addrule(struct pf_krule *rule, uint32_t ticket, int rs_num; int error = 0; - if ((rule->return_icmp >> 8) > ICMP_MAXTYPE) { - error = EINVAL; - goto errout_unlocked; - } +#define ERROUT(x) ERROUT_FUNCTION(errout, x) +#define ERROUT_UNLOCKED(x) ERROUT_FUNCTION(errout_unlocked, x) -#define ERROUT(x) ERROUT_FUNCTION(errout, x) + if ((rule->return_icmp >> 8) > ICMP_MAXTYPE) + ERROUT_UNLOCKED(EINVAL); if ((error = pf_rule_checkaf(rule))) - ERROUT(error); + ERROUT_UNLOCKED(error); if (pf_validate_range(rule->src.port_op, rule->src.port)) - ERROUT(EINVAL); + ERROUT_UNLOCKED(EINVAL); if (pf_validate_range(rule->dst.port_op, rule->dst.port)) - ERROUT(EINVAL); + ERROUT_UNLOCKED(EINVAL); if (rule->ifname[0]) kif = pf_kkif_create(M_WAITOK); @@ -2294,6 +2293,7 @@ pf_ioctl_addrule(struct pf_krule *rule, uint32_t ticket, return (0); #undef ERROUT +#undef ERROUT_UNLOCKED errout: PF_RULES_WUNLOCK(); PF_CONFIG_UNLOCK();