From 9085232872a16024bd3f016576f224a95687a67f Mon Sep 17 00:00:00 2001 From: Kristof Provost Date: Tue, 9 Jul 2024 20:49:49 +0200 Subject: [PATCH] pf: fix sctp deadlock It is possible for pf_test_state_sctp() to find a state and still return PF_DROP (or not PF_PASS, to be exact). In that case we would run pf_test_rule() unconditionally, but this would overwrite the (locked!) state pointer pf_test_state_sctp() gave us. As a result we will later deadlock, trying the lock the already locked state. Do what we do for UDP and TCP, and explicitly check s for NULL before we run pf_test_rule(). MFC after: 1 week Sponsored by: Orange Business Services (cherry picked from commit a9639adaedb4d67340c4ae386fe8fcd18e4a8a21) --- sys/netpfil/pf/pf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index d0129a49aa0..6b26f9bd24e 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -8206,7 +8206,7 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, V_pfsync_update_state_ptr(s); r = s->rule.ptr; a = s->anchor.ptr; - } else { + } else if (s == NULL) { action = pf_test_rule(&r, &s, kif, m, off, &pd, &a, &ruleset, inp); } @@ -8815,7 +8815,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb V_pfsync_update_state_ptr(s); r = s->rule.ptr; a = s->anchor.ptr; - } else { + } else if (s == NULL) { action = pf_test_rule(&r, &s, kif, m, off, &pd, &a, &ruleset, inp); }