d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf: do not remove kifs that are referenced by rules

Browse Source 
Even if a kif doesn't have an ifp or if_group pointer we still can't delete it
if it's referenced by a rule. In other words: we must check rulerefs as well.

While we're here also teach pfi_kif_unref() not to remove kifs with flags.

Reported-by: syzbot+b31d1d7e12c5d4d42f28@syzkaller.appspotmail.com
MFC after:   2 weeks
This commit is contained in:
Kristof Provost 2020-10-13 11:04:00 +00:00
parent ed50d40834
commit 52b83a0618
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=366667
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/netpfil/pf/pf_if.c
View File

@ -282,8 +282,10 @@ pfi_kif_unref(struct pfi_kif *kif)
if (kif->pfik_rulerefs > 0)
return;
/* kif referencing an existing ifnet or group should exist. */
if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == V_pfi_all)
/* kif referencing an existing ifnet or group or holding flags should
* exist. */
if (kif->pfik_ifp != NULL || kif->pfik_group != NULL ||
kif == V_pfi_all || kif->pfik_flags != 0)
return;
RB_REMOVE(pfi_ifhead, &V_pfi_ifs, kif);
@ -833,7 +835,7 @@ pfi_clear_flags(const char *name, int flags)
p->pfik_flags &= ~flags;
if (p->pfik_ifp == NULL && p->pfik_group == NULL &&
p->pfik_flags == 0) {
p->pfik_flags == 0 && p->pfik_rulerefs == 0) {
/* Delete this kif. */
RB_REMOVE(pfi_ifhead, &V_pfi_ifs, p);
free(p, PFI_MTYPE);