jimzah/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2024-12-03 14:48:57 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

MFC r314810:

Browse Source 
pf: Fix a crash in low-memory situations

If the call to pf_state_key_clone() in pf_get_translation() fails (i.e. there's
no more memory for it) it frees skp. This is wrong, because skp is a
pf_state_key **, so we need to free *skp, as is done later in the function.
Getting it wrong means we try to free a stack variable of the calling
pf_test_rule() function, and we panic.
This commit is contained in:
Kristof Provost 2017-03-09 03:20:20 +00:00
parent d21518123c
commit ab00b209e8
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/stable/10/; revision=314940
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/netpfil/pf/pf_lb.c
View File

@ -550,7 +550,7 @@ pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction,
return (NULL);
*nkp = pf_state_key_clone(*skp);
if (*nkp == NULL) {
uma_zfree(V_pf_state_key_z, skp);
uma_zfree(V_pf_state_key_z, *skp);
*skp = NULL;
return (NULL);
}