diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2026-04-16 13:49:26 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2026-04-17 11:55:06 +0000 |
| commit | 05ac1013984ced5b8b57430fe92a7074e34054ce (patch) | |
| tree | 2c6c49cdd07129a4b84aba084cd5ed89740ab80c | |
| parent | 95fe1ba5579df2fe204ad30d892160966677ae98 (diff) | |
pf: fix error handling in pf_sourcelim_add()
There are two issues in pf_sourcelim_add() error path:
- stale pointers are left in pf_sourcelim_id_tree_inactive when
duplicate source limiter instance is found in pf_sourcelim_nm_tree
- overload table may leak when insertion of new source limiter instance
fails.
Both issues reported and patch submitted by:
Renaud Allard <renaud () allard ! it>
OK sashan@
Obtained from: OpenBSD, sashan <sashan@openbsd.org>, 32063577ec
Sponsored by: Rubicon Communications, LLC ("Netgate")
| -rw-r--r-- | sys/netpfil/pf/pf_ioctl.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index a2e12b3065d0..8b2ff108d9cb 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2239,7 +2239,7 @@ pf_sourcelim_add(const struct pfioc_sourcelim *ioc) if (RB_INSERT(pf_sourcelim_nm_tree, &V_pf_sourcelim_nm_tree_inactive, pfsrlim) != NULL) { - RB_INSERT(pf_sourcelim_nm_tree, &V_pf_sourcelim_nm_tree_inactive, + RB_REMOVE(pf_sourcelim_nm_tree, &V_pf_sourcelim_nm_tree_inactive, pfsrlim); error = EBUSY; goto unlock; @@ -2252,6 +2252,8 @@ pf_sourcelim_add(const struct pfioc_sourcelim *ioc) return (0); unlock: + if (pfsrlim->pfsrlim_overload.table != NULL) + pfr_detach_table(pfsrlim->pfsrlim_overload.table); PF_RULES_WUNLOCK(); free: |