Author: cy
Date: Fri Apr 14 03:54:36 2017
New Revision: 316809
URL: https://svnweb.freebsd.org/changeset/base/316809
Log:
Fix a use after free panic in ipfilter's fragment processing.
Memory is malloc'd, then a search for a match in the fragment table
is made and if the fragment matches, the wrong fragment table is
freed, causing a use after free panic. This commit fixes this.
A symptom of the problem is a kernel page fault in bcopy() called by
ipf_frag_lookup() at line 715 in ip_frag.c. Another symptom is a
kernel page fault in ipf_frag_delete() when called by ipf_frag_expire()
via ipf_slowtimer().
MFC after: 1 week
Modified:
head/sys/contrib/ipfilter/netinet/ip_frag.c
Modified: head/sys/contrib/ipfilter/netinet/ip_frag.c
==============================================================================
--- head/sys/contrib/ipfilter/netinet/ip_frag.c Fri Apr 14 03:23:03 2017
(r316808)
+++ head/sys/contrib/ipfilter/netinet/ip_frag.c Fri Apr 14 03:54:36 2017
(r316809)
@@ -474,7 +474,7 @@ ipfr_frag_new(softc, softf, fin, pass, t
IPFR_CMPSZ)) {
RWLOCK_EXIT(lock);
FBUMPD(ifs_exists);
- KFREE(fra);
+ KFREE(fran);
return NULL;
}
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
