diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2024-07-09 18:49:49 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2024-07-17 15:23:48 +0000 |
| commit | 1981d52a6e295f4b01a2cb95007806605d5e86ee (patch) | |
| tree | 9bc6e7f3bc678b78103a84402d022adb90a8aac7 | |
| parent | e99c76951e1092464037cd4bcbce1e05a3589acc (diff) | |
| download | src-1981d52a6e295f4b01a2cb95007806605d5e86ee.tar.gz src-1981d52a6e295f4b01a2cb95007806605d5e86ee.zip | |
pf: fix sctp deadlock
It is possible for pf_test_state_sctp() to find a state and still return
PF_DROP (or not PF_PASS, to be exact). In that case we would run pf_test_rule()
unconditionally, but this would overwrite the (locked!) state pointer
pf_test_state_sctp() gave us. As a result we will later deadlock, trying the
lock the already locked state.
Do what we do for UDP and TCP, and explicitly check s for NULL before we run
pf_test_rule().
MFC after: 1 week
Sponsored by: Orange Business Services
(cherry picked from commit a9639adaedb4d67340c4ae386fe8fcd18e4a8a21)
| -rw-r--r-- | sys/netpfil/pf/pf.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 6671839fc5ab..4eed6dd31860 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -8164,7 +8164,7 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, V_pfsync_update_state_ptr(s); r = s->rule.ptr; a = s->anchor.ptr; - } else { + } else if (s == NULL) { action = pf_test_rule(&r, &s, kif, m, off, &pd, &a, &ruleset, inp); } @@ -8769,7 +8769,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb V_pfsync_update_state_ptr(s); r = s->rule.ptr; a = s->anchor.ptr; - } else { + } else if (s == NULL) { action = pf_test_rule(&r, &s, kif, m, off, &pd, &a, &ruleset, inp); } |