upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-04 22:32:43 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

ipsec: fix a panic with INVARIANTS

Browse source 
When adding an SPD entry that already exists, a refcount wraparound
panic is encountered. This was caused from dropping a reference on the
wrong security policy.

Fixes:          4920e38fec ("ipsec: fix race condition in key.c")
Reviewed by:	wma
Sponsored by:   Klara Inc.
Differential Revision:	https://reviews.freebsd.org/D33100
This commit is contained in:
Robert Wing 2021-12-03 14:22:23 -09:00
parent a21f086a33
commit fc21aafe5f
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sys/netipsec/key.c
View file

@ -2039,7 +2039,7 @@ key_spdadd(struct socket *so, struct mbuf *m, const struct sadb_msghdr *mhp)
__func__, oldsp));
KEYDBG(KEY_DATA, kdebug_secpolicy(oldsp));
} else {
key_freesp(&newsp);
key_freesp(&oldsp);
ipseclog((LOG_DEBUG,
"%s: a SP entry exists already.\n", __func__));
return (key_senderror(so, m, EEXIST));