upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

pf: fix double free in pf_state_key_attach()

Browse source 
In 371bd29d4b we fixed a state key leak, but unintentionally introduced a double free.
We pass through the relevant code twice, first for PF_SK_WIRE, then for
PF_SK_STACK. If we fail to attach on the second pass we have a more complex
cleanup job, handled by pf_detach_state(). We must only free the state keys
manually on the first pass, on the second one pf_detach_state() takes care of
everything.

Tested by:	yds <yds@Necessitu.de>
Fixes:		371bd29d4b22257a7e92e1e711cca3d94cfbd00d
MFC after:	2 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 01eb1261443dddcb50a3a278f1278fffdfb0d36e)
This commit is contained in:
Kristof Provost 2024-12-11 23:27:21 +01:00 committed by Franco Fichtner
parent ec74127326
commit 75ba8d345e
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
sys/netpfil/pf/pf.c
View file

@ -1359,11 +1359,13 @@ keyattach:
s->timeout = PFTM_UNLINKED;
PF_HASHROW_UNLOCK(ih);
KEYS_UNLOCK();
uma_zfree(V_pf_state_key_z, skw);
if (skw != sks)
uma_zfree(V_pf_state_key_z, sks);
if (idx == PF_SK_STACK)
if (idx == PF_SK_WIRE) {
uma_zfree(V_pf_state_key_z, skw);
if (skw != sks)
uma_zfree(V_pf_state_key_z, sks);
} else {
pf_detach_state(s);
}
return (EEXIST); /* collision! */
}
}