d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pf: fix error-case leaks in pf_create_state

Browse Source 
The hand-rolled clean up failed to free counters.

Reviewed by:	kp
Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Mateusz Guzik 2021-06-28 20:29:58 +02:00
parent b33d1898c1
commit 7f025db57c
1 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/netpfil/pf/pf.c
View File

@ -3827,7 +3827,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
REASON_SET(&reason, PFRES_MAPFAILED);
pf_src_tree_remove_state(s);
STATE_DEC_COUNTERS(s);
uma_zfree(V_pf_state_z, s);
pf_free_state(s);
goto csfailed;
}
s->rt_kif = r->rpool.cur->kif;
@ -3849,7 +3849,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
REASON_SET(&reason, PFRES_MEMORY);
pf_src_tree_remove_state(s);
STATE_DEC_COUNTERS(s);
uma_zfree(V_pf_state_z, s);
pf_free_state(s);
return (PF_DROP);
}
if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub &&
@ -3859,10 +3859,9 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
DPFPRINTF(PF_DEBUG_URGENT,
("pf_normalize_tcp_stateful failed on first "
"pkt\n"));
pf_normalize_tcp_cleanup(s);
pf_src_tree_remove_state(s);
STATE_DEC_COUNTERS(s);
uma_zfree(V_pf_state_z, s);
pf_free_state(s);
return (PF_DROP);
}
}
@ -3886,12 +3885,10 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
if (pf_state_insert(BOUND_IFACE(r, kif), kif,
(pd->dir == PF_IN) ? sk : nk,
(pd->dir == PF_IN) ? nk : sk, s)) {
if (pd->proto == IPPROTO_TCP)
pf_normalize_tcp_cleanup(s);
REASON_SET(&reason, PFRES_STATEINS);
pf_src_tree_remove_state(s);
STATE_DEC_COUNTERS(s);
uma_zfree(V_pf_state_z, s);
pf_free_state(s);
return (PF_DROP);
} else
*sm = s;