aboutsummaryrefslogtreecommitdiff
path: root/sys/netpfil/pf
diff options
context:
space:
mode:
authorKristof Provost <kp@FreeBSD.org>2015-07-29 06:35:36 +0000
committerKristof Provost <kp@FreeBSD.org>2015-07-29 06:35:36 +0000
commit48c29b118e8229f19397bb8e205a086fdf0ed468 (patch)
treea807aaf2516e31a20415dd96f1e588387b072b6b /sys/netpfil/pf
parent3720b82fa855d19d07a7d1ea9ec7eb01a320a866 (diff)
downloadsrc-48c29b118e8229f19397bb8e205a086fdf0ed468.tar.gz
src-48c29b118e8229f19397bb8e205a086fdf0ed468.zip
pf: Always initialise pf_fragment.fr_flags
When we allocate the struct pf_fragment in pf_fillup_fragment() we forgot to initialise the fr_flags field. As a result we sometimes mistakenly thought the fragment to not be a buffered fragment. This resulted in panics because we'd end up freeing the pf_fragment but not removing it from V_pf_fragqueue (believing it to be part of V_pf_cachequeue). The next time we iterated V_pf_fragqueue we'd use a freed object and panic. While here also fix a pf_fragment use after free in pf_normalize_ip(). pf_reassemble() frees the pf_fragment, so we can't use it any more. PR: 201879, 201932 MFC after: 5 days
Notes
Notes: svn path=/head/; revision=285999
Diffstat (limited to 'sys/netpfil/pf')
-rw-r--r--sys/netpfil/pf/pf_norm.c4
1 files changed, 1 insertions, 3 deletions
diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c
index 384f5653bdec..497f0ed41fc7 100644
--- a/sys/netpfil/pf/pf_norm.c
+++ b/sys/netpfil/pf/pf_norm.c
@@ -431,6 +431,7 @@ pf_fillup_fragment(struct pf_fragment_cmp *key, struct pf_frent *frent,
}
*(struct pf_fragment_cmp *)frag = *key;
+ frag->fr_flags = 0;
frag->fr_timeout = time_second;
frag->fr_maxlen = frent->fe_len;
TAILQ_INIT(&frag->fr_queue);
@@ -1284,9 +1285,6 @@ pf_normalize_ip(struct mbuf **m0, int dir, struct pfi_kif *kif, u_short *reason,
if (m == NULL)
return (PF_DROP);
- if (frag != NULL && (frag->fr_flags & PFFRAG_DROP))
- goto drop;
-
h = mtod(m, struct ip *);
} else {
/* non-buffering fragment cache (drops or masks overlaps) */