Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 25 Sep 2023 12:27:10 GMT
From:      Kristof Provost <kp@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org
Subject:   git: ddca690373e5 - stable/13 - pf: fix state leak
Message-ID:  <202309251227.38PCRAYT094687@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
The branch stable/13 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=ddca690373e565a6e86ac1c0e025563ded0a686c

commit ddca690373e565a6e86ac1c0e025563ded0a686c
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2023-09-06 07:58:07 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2023-09-25 12:27:05 +0000

    pf: fix state leak
    
    If we hit the csfailed case in pf_create_state() we may have allocated
    a state, so we must also free it. While here reduce the amount of
    duplicated cleanup code.
    
    MFC after:      2 weeks
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D41772
    
    (cherry picked from commit b6ce41118bb11d3db86eae8fbebc8c198e8b330d)
---
 sys/netpfil/pf/pf.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 99fca2d6fabf..51f81172bad2 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -4317,10 +4317,6 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
 	if (r->rt) {
 		if (pf_map_addr(pd->af, r, pd->src, &s->rt_addr, NULL, &sn)) {
 			REASON_SET(&reason, PFRES_MAPFAILED);
-			pf_src_tree_remove_state(s);
-			s->timeout = PFTM_UNLINKED;
-			STATE_DEC_COUNTERS(s);
-			pf_free_state(s);
 			goto csfailed;
 		}
 		s->rt_kif = r->rpool.cur->kif;
@@ -4381,11 +4377,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
 	    (pd->dir == PF_IN) ? sk : nk,
 	    (pd->dir == PF_IN) ? nk : sk, s)) {
 		REASON_SET(&reason, PFRES_STATEINS);
-		pf_src_tree_remove_state(s);
-		s->timeout = PFTM_UNLINKED;
-		STATE_DEC_COUNTERS(s);
-		pf_free_state(s);
-		return (PF_DROP);
+		goto drop;
 	} else
 		*sm = s;
 
@@ -4461,6 +4453,14 @@ csfailed:
 		PF_HASHROW_UNLOCK(sh);
 	}
 
+drop:
+	if (s != NULL) {
+		pf_src_tree_remove_state(s);
+		s->timeout = PFTM_UNLINKED;
+		STATE_DEC_COUNTERS(s);
+		pf_free_state(s);
+	}
+
 	return (PF_DROP);
 }

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202309251227.38PCRAYT094687>