aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKristof Provost <kp@FreeBSD.org>2021-09-23 08:39:49 +0000
committerKristof Provost <kp@FreeBSD.org>2021-09-30 11:51:32 +0000
commit3c9253c2f6d1f076ef35a5538b207a5cc866480f (patch)
tree2c822cc8fff29029f079aaa45c53fc900ea923c9
parentcc8e726c85bee3f3da0fb02c12028f2310a7ee17 (diff)
downloadsrc-3c9253c2f6d1f076ef35a5538b207a5cc866480f.tar.gz
src-3c9253c2f6d1f076ef35a5538b207a5cc866480f.zip
pf: fix pagefault in pf_getstatus()
We can't copyout() while holding a lock, in case it triggers a page fault. Release the lock before copyout, which is safe because we've already copied all the data into the nvlist. PR: 258601 Reviewed by: mjg MFC after: 1 week Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D32076 (cherry picked from commit cb13059663e455b3fc69c293dadec53c164490dc)
-rw-r--r--sys/netpfil/pf/pf_ioctl.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index aac47e5512cf..7a8d0cdda836 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -5017,11 +5017,14 @@ pf_getstatus(struct pfioc_nv *nv)
else if (nv->size < nv->len)
ERROUT(ENOSPC);
+ PF_RULES_RUNLOCK();
error = copyout(nvlpacked, nv->data, nv->len);
+ goto done;
#undef ERROUT
errout:
PF_RULES_RUNLOCK();
+done:
free(nvlpacked, M_NVLIST);
nvlist_destroy(nvc);
nvlist_destroy(nvl);