diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2024-07-09 18:49:49 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2024-07-17 21:54:35 +0000 |
| commit | 5324cf4f1cf9d93351f966d4a76cf0389d08f3c6 (patch) | |
| tree | 6b638aae2a865285c5f86d952c2788b2405b30b5 | |
| parent | a69d075e96a60273a9b39005b3e765e6476a8b53 (diff) | |
| download | src-5324cf4f1cf9d93351f966d4a76cf0389d08f3c6.tar.gz src-5324cf4f1cf9d93351f966d4a76cf0389d08f3c6.zip | |
pf: fix sctp deadlock
It is possible for pf_test_state_sctp() to find a state and still return
PF_DROP (or not PF_PASS, to be exact). In that case we would run pf_test_rule()
unconditionally, but this would overwrite the (locked!) state pointer
pf_test_state_sctp() gave us. As a result we will later deadlock, trying the
lock the already locked state.
Do what we do for UDP and TCP, and explicitly check s for NULL before we run
pf_test_rule().
MFC after: 1 week
Sponsored by: Orange Business Services
(cherry picked from commit a9639adaedb4d67340c4ae386fe8fcd18e4a8a21)
| -rw-r--r-- | sys/netpfil/pf/pf.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 97ae44cff69f..e99886a2d120 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -7310,7 +7310,7 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb * V_pfsync_update_state_ptr(s); r = s->rule.ptr; a = s->anchor.ptr; - } else { + } else if (s == NULL) { action = pf_test_rule(&r, &s, pd.dir, kif, m, off, &pd, &a, &ruleset, inp); } @@ -7838,7 +7838,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb V_pfsync_update_state_ptr(s); r = s->rule.ptr; a = s->anchor.ptr; - } else { + } else if (s == NULL) { action = pf_test_rule(&r, &s, pd.dir, kif, m, off, &pd, &a, &ruleset, inp); } |