Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 13 Nov 2024 10:34:31 GMT
From:      Kristof Provost <kp@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org
Subject:   git: 371bd29d4b22 - main - pf: fix potential state key leak
Message-ID:  <202411131034.4ADAYVqL046427@gitrepo.freebsd.org>

next in thread | raw e-mail | index | archive | help
The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=371bd29d4b22257a7e92e1e711cca3d94cfbd00d

commit 371bd29d4b22257a7e92e1e711cca3d94cfbd00d
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-11-09 09:53:37 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-11-13 09:34:08 +0000

    pf: fix potential state key leak
    
    If we fail to attach the new state keys in pf_state_key_attach() we are
    expected to free both keys. Do so.
    Note that in some scenarios both key are the same, so check for that
    before freeing.
    
    MFC after:      2 weeks
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D47495
---
 sys/netpfil/pf/pf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 90ec2b1ed033..691cb697a659 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -1433,7 +1433,9 @@ keyattach:
 					s->timeout = PFTM_UNLINKED;
 					PF_HASHROW_UNLOCK(ih);
 					KEYS_UNLOCK();
-					uma_zfree(V_pf_state_key_z, sk);
+					uma_zfree(V_pf_state_key_z, skw);
+					if (skw != sks)
+						uma_zfree(V_pf_state_key_z, sks);
 					if (idx == PF_SK_STACK)
 						pf_detach_state(s);
 					return (EEXIST); /* collision! */



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202411131034.4ADAYVqL046427>