diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2023-11-22 13:44:03 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2023-11-22 13:47:14 +0000 |
| commit | b01cad6d3a8523101e7915809144f47e3045067f (patch) | |
| tree | 8e3342500e3b887d0a28799610b5cc7b5dfc7cf3 | |
| parent | 8ec79e8ae07d34a371eeb09329ad32993aecd906 (diff) | |
| download | src-b01cad6d3a8523101e7915809144f47e3045067f.tar.gz src-b01cad6d3a8523101e7915809144f47e3045067f.zip | |
ip_mroute: handle V_mfchashtbl allocation failure
We allocate V_mfchashtbl with HASH_NOWAIT (which maps to M_NOWAIT), so
this allocation may fail. As we didn't handle that failure we could end
up dereferencing a NULL pointer later (e.g. during X_ip_mrouter_done()).
Do the obvious thing and fail out if we cannot allocate the table.
See also: https://redmine.pfsense.org/issues/14917
Sponsored by: Rubicon Communications, LLC ("Netgate")
| -rw-r--r-- | sys/netinet/ip_mroute.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/netinet/ip_mroute.c b/sys/netinet/ip_mroute.c index cda5f160e8fb..f789c6eed835 100644 --- a/sys/netinet/ip_mroute.c +++ b/sys/netinet/ip_mroute.c @@ -708,6 +708,10 @@ ip_mrouter_init(struct socket *so, int version) V_mfchashtbl = hashinit_flags(mfchashsize, M_MRTABLE, &V_mfchash, HASH_NOWAIT); + if (V_mfchashtbl == NULL) { + MRW_WUNLOCK(); + return (ENOMEM); + } /* Create upcall ring */ mtx_init(&V_bw_upcalls_ring_mtx, "mroute upcall buf_ring mtx", NULL, MTX_DEF); |