upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

routing: Fix use-after-free in finalize_nhop

Browse source 
FIB_NH_LOG calls the `nhop_get_upper_family(nh)` to read
`nh->nh_priv->nh_upper_family` for failure logging.
Call FIB_NH_LOG before freeing nh so failures are logged
without causing a panic.

MFC after: 3 days

(cherry picked from commit 7d38eb720a8d8345949986d779e785984ae19ae0)
This commit is contained in:
Pouria Mousavizadeh Tehrani 2026-04-14 13:06:53 +03:30 committed by Franco Fichtner
parent 91e9dca98e
commit 29fa156859
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
sys/net/route/nhop_ctl.c
View file

@ -492,17 +492,17 @@ finalize_nhop(struct nh_control *ctl, struct nhop_object *nh, bool link)
/* Allocate per-cpu packet counter */
nh->nh_pksent = counter_u64_alloc(M_NOWAIT);
if (nh->nh_pksent == NULL) {
FIB_NH_LOG(LOG_WARNING, nh, "counter_u64_alloc() failed");
nhop_free(nh);
RTSTAT_INC(rts_nh_alloc_failure);
FIB_NH_LOG(LOG_WARNING, nh, "counter_u64_alloc() failed");
return (ENOMEM);
}
if (!reference_nhop_deps(nh)) {
FIB_NH_LOG(LOG_WARNING, nh, "interface reference failed");
counter_u64_free(nh->nh_pksent);
nhop_free(nh);
RTSTAT_INC(rts_nh_alloc_failure);
FIB_NH_LOG(LOG_WARNING, nh, "interface reference failed");
return (EAGAIN);
}