CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2023/10/11 16:13:16
Modified files:
sys/net : pfkeyv2.c pfkeyv2_convert.c
sys/netinet : ip_ipsp.c ip_ipsp.h
Log message:
Prevent deref-after-free when tdb_timeout() fires on invalid new tdb.
When receiving a pfkeyv2 SADB_ADD message, a newly created tdb can
fail in tdb_init(), which causes the tdb to not get added to the
global tdb list and an immediate dereference. If a lifetime timeout
triggers on this tdb, it will unconditionally try to remove it from
the list and in the process deref once more than allowed,
causing a one bit corruption in the already freed up slot in the
tdb pool.
We resolve this issue by moving timeout_add() after tdb_init()
just before puttdb(). This means tdbs failing initialization
get discarded immediately as they only hold a single reference.
Valid tdbs get their timeouts activated just before we add them
to the tdb list, meaning the timeout can safely assume they are
linked.
Feedback from mvs@ and millert@
ok mvs@ mbuhl@
