d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ipsec: Return error code if no matching SA was found

Browse Source 
If we matched SP to a packet, but no associated SA was found
ipsec4_allocsa will return NULL while setting error=0.
This resulted in use after free and potential kernel panic.
Return EINPROGRESS if the case described above instead.

Obtained from:		Semihalf
Sponsored by:		Stormshield
Differential revision:	https://reviews.freebsd.org/D30994
This commit is contained in:
Kornel Duleba 2021-08-13 09:35:08 +02:00 committed by Wojciech Macek
parent 6b66194bcb
commit a16771de4c
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/netipsec/ipsec_output.c
View File

@ -322,6 +322,12 @@ ipsec4_check_pmtu(struct mbuf *m, struct secpolicy *sp, int forwarding)
sav = ipsec4_allocsa(m, sp, &idx, &error);
if (sav == NULL) {
key_freesp(&sp);
/*
* No matching SA was found and SADB_ACQUIRE message was generated.
* Since we have matched a SP to this packet drop it silently.
*/
if (error == 0)
error = EINPROGRESS;
if (error != EJUSTRETURN)
m_freem(m);