[Bug 260867] pf: divert-to packets infinitely loop when written back to divert socket

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=260867

--- Comment #9 from [email protected] ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=66f2f1c83247f05a3a599d7e88c7e7efbedd16b5

commit 66f2f1c83247f05a3a599d7e88c7e7efbedd16b5
Author:     Kristof Provost <[email protected]>
AuthorDate: 2025-11-15 13:44:54 +0000
Commit:     Kristof Provost <[email protected]>
CommitDate: 2025-11-15 21:38:21 +0000

    pf: handle divert packets

    In a divert setup pf_test_state() may return PF_PASS, but not set the state
    pointer. We didn't handle that, and as a result crashed immediately
afterwards
    trying to dereference that NULL state pointer.

    Add a test case to provoke the problem.

    PR:             260867
    MFC after:      2 weeks
    Submitted by:   Phil Budne <[email protected]>
    Sponsored by:   Rubicon Communications, LLC ("Netgate")

 sys/netpfil/pf/pf.c               | 20 ++++++++++--------
 tests/sys/netpfil/pf/divert-to.sh | 43 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 8 deletions(-)

-- 
You are receiving this mail because:
You are the assignee for the bug.