[Bug 260867] pf: divert-to packets infinitely loop when written back to divert socket

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=260867

--- Comment #13 from [email protected] ---
A commit in branch stable/14 references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=a009793a5e5fad0b42cb0a158dcbccd5eff40d9f

commit a009793a5e5fad0b42cb0a158dcbccd5eff40d9f
Author:     Kristof Provost <[email protected]>
AuthorDate: 2025-11-15 13:44:54 +0000
Commit:     Kristof Provost <[email protected]>
CommitDate: 2025-11-30 10:26:28 +0000

    pf: handle divert packets

    In a divert setup pf_test_state() may return PF_PASS, but not set the state
    pointer. We didn't handle that, and as a result crashed immediately
afterwards
    trying to dereference that NULL state pointer.

    Add a test case to provoke the problem.

    PR:             260867
    MFC after:      2 weeks
    Submitted by:   Phil Budne <[email protected]>
    Sponsored by:   Rubicon Communications, LLC ("Netgate")

    (cherry picked from commit 66f2f1c83247f05a3a599d7e88c7e7efbedd16b5)

 sys/netpfil/pf/pf.c               | 20 +++++++++++-------
 tests/sys/netpfil/pf/divert-to.sh | 44 +++++++++++++++++++++++++++++++++++++--
 2 files changed, 54 insertions(+), 10 deletions(-)

-- 
You are receiving this mail because:
You are the assignee for the bug.