aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKristof Provost <kp@FreeBSD.org>2024-12-11 22:27:21 +0000
committerKristof Provost <kp@FreeBSD.org>2024-12-17 20:33:11 +0000
commit01eb1261443dddcb50a3a278f1278fffdfb0d36e (patch)
treede9c7f85fc4d6f32b4deb0bb25f05e7f977857eb
parent4f58451269930e227e527c8e077d7255bf2fae14 (diff)
pf: fix double free in pf_state_key_attach()
In 371bd29d4b we fixed a state key leak, but unintentionally introduced a double free. We pass through the relevant code twice, first for PF_SK_WIRE, then for PF_SK_STACK. If we fail to attach on the second pass we have a more complex cleanup job, handled by pf_detach_state(). We must only free the state keys manually on the first pass, on the second one pf_detach_state() takes care of everything. Tested by: yds <yds@Necessitu.de> Fixes: 371bd29d4b22257a7e92e1e711cca3d94cfbd00d MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate")
-rw-r--r--sys/netpfil/pf/pf.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index f2e19693b863..11d37747b3a0 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -1477,11 +1477,13 @@ keyattach:
s->timeout = PFTM_UNLINKED;
PF_HASHROW_UNLOCK(ih);
KEYS_UNLOCK();
- uma_zfree(V_pf_state_key_z, skw);
- if (skw != sks)
- uma_zfree(V_pf_state_key_z, sks);
- if (idx == PF_SK_STACK)
+ if (idx == PF_SK_WIRE) {
+ uma_zfree(V_pf_state_key_z, skw);
+ if (skw != sks)
+ uma_zfree(V_pf_state_key_z, sks);
+ } else {
pf_detach_state(s);
+ }
return (EEXIST); /* collision! */
}
}