Date: Tue, 13 Oct 2020 11:04:00 +0000 (UTC) From: Kristof Provost <kp@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r366667 - head/sys/netpfil/pf Message-ID: <202010131104.09DB40vI080880@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kp Date: Tue Oct 13 11:04:00 2020 New Revision: 366667 URL: https://svnweb.freebsd.org/changeset/base/366667 Log: pf: do not remove kifs that are referenced by rules Even if a kif doesn't have an ifp or if_group pointer we still can't delete it if it's referenced by a rule. In other words: we must check rulerefs as well. While we're here also teach pfi_kif_unref() not to remove kifs with flags. Reported-by: syzbot+b31d1d7e12c5d4d42f28@syzkaller.appspotmail.com MFC after: 2 weeks Modified: head/sys/netpfil/pf/pf_if.c Modified: head/sys/netpfil/pf/pf_if.c ============================================================================== --- head/sys/netpfil/pf/pf_if.c Tue Oct 13 10:31:12 2020 (r366666) +++ head/sys/netpfil/pf/pf_if.c Tue Oct 13 11:04:00 2020 (r366667) @@ -282,8 +282,10 @@ pfi_kif_unref(struct pfi_kif *kif) if (kif->pfik_rulerefs > 0) return; - /* kif referencing an existing ifnet or group should exist. */ - if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == V_pfi_all) + /* kif referencing an existing ifnet or group or holding flags should + * exist. */ + if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || + kif == V_pfi_all || kif->pfik_flags != 0) return; RB_REMOVE(pfi_ifhead, &V_pfi_ifs, kif); @@ -833,7 +835,7 @@ pfi_clear_flags(const char *name, int flags) p->pfik_flags &= ~flags; if (p->pfik_ifp == NULL && p->pfik_group == NULL && - p->pfik_flags == 0) { + p->pfik_flags == 0 && p->pfik_rulerefs == 0) { /* Delete this kif. */ RB_REMOVE(pfi_ifhead, &V_pfi_ifs, p); free(p, PFI_MTYPE);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202010131104.09DB40vI080880>