The branch main has been updated by kp:
URL:
https://cgit.FreeBSD.org/src/commit/?id=01eb1261443dddcb50a3a278f1278fffdfb0d36e
commit 01eb1261443dddcb50a3a278f1278fffdfb0d36e
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2024-12-11 22:27:21 +0000
Commit: Kristof Provost <k...@freebsd.org>
CommitDate: 2024-12-17 20:33:11 +0000
pf: fix double free in pf_state_key_attach()
In 371bd29d4b we fixed a state key leak, but unintentionally introduced a
double free.
We pass through the relevant code twice, first for PF_SK_WIRE, then for
PF_SK_STACK. If we fail to attach on the second pass we have a more complex
cleanup job, handled by pf_detach_state(). We must only free the state keys
manually on the first pass, on the second one pf_detach_state() takes care
of
everything.
Tested by: yds <y...@necessitu.de>
Fixes: 371bd29d4b22257a7e92e1e711cca3d94cfbd00d
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
sys/netpfil/pf/pf.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index f2e19693b863..11d37747b3a0 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -1477,11 +1477,13 @@ keyattach:
s->timeout = PFTM_UNLINKED;
PF_HASHROW_UNLOCK(ih);
KEYS_UNLOCK();
- uma_zfree(V_pf_state_key_z, skw);
- if (skw != sks)
- uma_zfree(V_pf_state_key_z,
sks);
- if (idx == PF_SK_STACK)
+ if (idx == PF_SK_WIRE) {
+ uma_zfree(V_pf_state_key_z,
skw);
+ if (skw != sks)
+
uma_zfree(V_pf_state_key_z, sks);
+ } else {
pf_detach_state(s);
+ }
return (EEXIST); /* collision! */
}
}
