pf: Fix a crash in low-memory situations
If the call to pf_state_key_clone() in pf_get_translation() fails (i.e. there's no more memory for it) it frees skp. This is wrong, because skp is a pf_state_key **, so we need to free *skp, as is done later in the function. Getting it wrong means we try to free a stack variable of the calling pf_test_rule() function, and we panic.
This commit is contained in:
parent
6d4f05fd11
commit
98a9874f7b
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=314810
@ -553,7 +553,7 @@ pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction,
|
||||
return (NULL);
|
||||
*nkp = pf_state_key_clone(*skp);
|
||||
if (*nkp == NULL) {
|
||||
uma_zfree(V_pf_state_key_z, skp);
|
||||
uma_zfree(V_pf_state_key_z, *skp);
|
||||
*skp = NULL;
|
||||
return (NULL);
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user