From owner-svn-src-stable@freebsd.org Sun Dec 11 04:02:40 2016 Return-Path: Delivered-To: svn-src-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 03462C70099; Sun, 11 Dec 2016 04:02:40 +0000 (UTC) (envelope-from marcel@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id B457A14A6; Sun, 11 Dec 2016 04:02:39 +0000 (UTC) (envelope-from marcel@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id uBB42cnq020577; Sun, 11 Dec 2016 04:02:38 GMT (envelope-from marcel@FreeBSD.org) Received: (from marcel@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id uBB42c1x020576; Sun, 11 Dec 2016 04:02:38 GMT (envelope-from marcel@FreeBSD.org) Message-Id: <201612110402.uBB42c1x020576@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: marcel set sender to marcel@FreeBSD.org using -f From: Marcel Moolenaar Date: Sun, 11 Dec 2016 04:02:38 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r309845 - stable/11/sys/netpfil/pf X-SVN-Group: stable-11 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 11 Dec 2016 04:02:40 -0000 Author: marcel Date: Sun Dec 11 04:02:38 2016 New Revision: 309845 URL: https://svnweb.freebsd.org/changeset/base/309845 Log: MFC r309394, r309787 Fix use-after-free bugs in pfsync(4) Modified: stable/11/sys/netpfil/pf/if_pfsync.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/netpfil/pf/if_pfsync.c ============================================================================== --- stable/11/sys/netpfil/pf/if_pfsync.c Sun Dec 11 03:59:37 2016 (r309844) +++ stable/11/sys/netpfil/pf/if_pfsync.c Sun Dec 11 04:02:38 2016 (r309845) @@ -161,8 +161,8 @@ static struct pfsync_q pfsync_qs[] = { { pfsync_out_del, sizeof(struct pfsync_del_c), PFSYNC_ACT_DEL_C } }; -static void pfsync_q_ins(struct pf_state *, int); -static void pfsync_q_del(struct pf_state *); +static void pfsync_q_ins(struct pf_state *, int, bool); +static void pfsync_q_del(struct pf_state *, bool); static void pfsync_update_state(struct pf_state *); @@ -542,7 +542,7 @@ pfsync_state_import(struct pfsync_state if (!(flags & PFSYNC_SI_IOCTL)) { st->state_flags &= ~PFSTATE_NOSYNC; if (st->state_flags & PFSTATE_ACK) { - pfsync_q_ins(st, PFSYNC_S_IACK); + pfsync_q_ins(st, PFSYNC_S_IACK, true); pfsync_push(sc); } } @@ -1509,7 +1509,7 @@ pfsync_sendout(int schedswi) struct ip *ip; struct pfsync_header *ph; struct pfsync_subheader *subh; - struct pf_state *st; + struct pf_state *st, *st_next; struct pfsync_upd_req_item *ur; int offset; int q, count = 0; @@ -1559,7 +1559,7 @@ pfsync_sendout(int schedswi) offset += sizeof(*subh); count = 0; - TAILQ_FOREACH(st, &sc->sc_qs[q], sync_list) { + TAILQ_FOREACH_SAFE(st, &sc->sc_qs[q], sync_list, st_next) { KASSERT(st->sync_state == q, ("%s: st->sync_state == q", __func__)); @@ -1668,7 +1668,7 @@ pfsync_insert_state(struct pf_state *st) if (sc->sc_len == PFSYNC_MINPKT) callout_reset(&sc->sc_tmo, 1 * hz, pfsync_timeout, V_pfsyncif); - pfsync_q_ins(st, PFSYNC_S_INS); + pfsync_q_ins(st, PFSYNC_S_INS, true); PFSYNC_UNLOCK(sc); st->sync_updates = 0; @@ -1789,7 +1789,7 @@ static void pfsync_update_state(struct pf_state *st) { struct pfsync_softc *sc = V_pfsyncif; - int sync = 0; + bool sync = false, ref = true; PF_STATE_LOCK_ASSERT(st); PFSYNC_LOCK(sc); @@ -1798,7 +1798,7 @@ pfsync_update_state(struct pf_state *st) pfsync_undefer_state(st, 0); if (st->state_flags & PFSTATE_NOSYNC) { if (st->sync_state != PFSYNC_S_NONE) - pfsync_q_del(st); + pfsync_q_del(st, true); PFSYNC_UNLOCK(sc); return; } @@ -1815,14 +1815,17 @@ pfsync_update_state(struct pf_state *st) if (st->key[PF_SK_WIRE]->proto == IPPROTO_TCP) { st->sync_updates++; if (st->sync_updates >= sc->sc_maxupdates) - sync = 1; + sync = true; } break; case PFSYNC_S_IACK: - pfsync_q_del(st); + pfsync_q_del(st, false); + ref = false; + /* FALLTHROUGH */ + case PFSYNC_S_NONE: - pfsync_q_ins(st, PFSYNC_S_UPD_C); + pfsync_q_ins(st, PFSYNC_S_UPD_C, ref); st->sync_updates = 0; break; @@ -1880,13 +1883,14 @@ static void pfsync_update_state_req(struct pf_state *st) { struct pfsync_softc *sc = V_pfsyncif; + bool ref = true; PF_STATE_LOCK_ASSERT(st); PFSYNC_LOCK(sc); if (st->state_flags & PFSTATE_NOSYNC) { if (st->sync_state != PFSYNC_S_NONE) - pfsync_q_del(st); + pfsync_q_del(st, true); PFSYNC_UNLOCK(sc); return; } @@ -1894,9 +1898,12 @@ pfsync_update_state_req(struct pf_state switch (st->sync_state) { case PFSYNC_S_UPD_C: case PFSYNC_S_IACK: - pfsync_q_del(st); + pfsync_q_del(st, false); + ref = false; + /* FALLTHROUGH */ + case PFSYNC_S_NONE: - pfsync_q_ins(st, PFSYNC_S_UPD); + pfsync_q_ins(st, PFSYNC_S_UPD, ref); pfsync_push(sc); break; @@ -1917,13 +1924,14 @@ static void pfsync_delete_state(struct pf_state *st) { struct pfsync_softc *sc = V_pfsyncif; + bool ref = true; PFSYNC_LOCK(sc); if (st->state_flags & PFSTATE_ACK) pfsync_undefer_state(st, 1); if (st->state_flags & PFSTATE_NOSYNC) { if (st->sync_state != PFSYNC_S_NONE) - pfsync_q_del(st); + pfsync_q_del(st, true); PFSYNC_UNLOCK(sc); return; } @@ -1934,22 +1942,24 @@ pfsync_delete_state(struct pf_state *st) switch (st->sync_state) { case PFSYNC_S_INS: /* We never got to tell the world so just forget about it. */ - pfsync_q_del(st); + pfsync_q_del(st, true); break; case PFSYNC_S_UPD_C: case PFSYNC_S_UPD: case PFSYNC_S_IACK: - pfsync_q_del(st); - /* FALLTHROUGH to putting it on the del list */ + pfsync_q_del(st, false); + ref = false; + /* FALLTHROUGH */ case PFSYNC_S_NONE: - pfsync_q_ins(st, PFSYNC_S_DEL); + pfsync_q_ins(st, PFSYNC_S_DEL, ref); break; default: panic("%s: unexpected sync state %d", __func__, st->sync_state); } + PFSYNC_UNLOCK(sc); } @@ -1977,7 +1987,7 @@ pfsync_clear_states(u_int32_t creatorid, } static void -pfsync_q_ins(struct pf_state *st, int q) +pfsync_q_ins(struct pf_state *st, int q, bool ref) { struct pfsync_softc *sc = V_pfsyncif; size_t nlen = pfsync_qs[q].len; @@ -2001,11 +2011,12 @@ pfsync_q_ins(struct pf_state *st, int q) sc->sc_len += nlen; TAILQ_INSERT_TAIL(&sc->sc_qs[q], st, sync_list); st->sync_state = q; - pf_ref_state(st); + if (ref) + pf_ref_state(st); } static void -pfsync_q_del(struct pf_state *st) +pfsync_q_del(struct pf_state *st, bool unref) { struct pfsync_softc *sc = V_pfsyncif; int q = st->sync_state; @@ -2017,7 +2028,8 @@ pfsync_q_del(struct pf_state *st) sc->sc_len -= pfsync_qs[q].len; TAILQ_REMOVE(&sc->sc_qs[q], st, sync_list); st->sync_state = PFSYNC_S_NONE; - pf_release_state(st); + if (unref) + pf_release_state(st); if (TAILQ_EMPTY(&sc->sc_qs[q])) sc->sc_len -= sizeof(struct pfsync_subheader);