Date: Fri, 25 Jan 2019 08:19:16 +0000 From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 235097] ci runs panic with use-after-free when running sys/netpfil/pf/nat tests Message-ID: <bug-235097-7501-smgqAqmKXI@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-235097-7501@https.bugs.freebsd.org/bugzilla/> References: <bug-235097-7501@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D235097 --- Comment #15 from Andrey V. Elsukov <ae@FreeBSD.org> --- (In reply to Andrey V. Elsukov from comment #14) > > We free the ifaddr, but we can still have a pointer to it in ifp->if_ad= dr. > > This check triggers, and in several test runs with this patch I've not > > managed to reproduce the panic any more. I'm doing more runs, because t= his > > problem comes and goes, but I hope this will be a useful pointer to som= eone > > who knows that code better than me. >=20 > ifa_free() does not free the memory immediately, so it is safe to make > access to ifp->if_addr while you are in NET_EPOCH() section. or while you keep the reference to if_addr, look at the history of recent changes to this code. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-235097-7501-smgqAqmKXI>