Re: pf: use-after-free and table leak in pf_sourcelim_add()
Alexandr Nedvedicky <[email protected]>
| Newsgroups | gmane.os.openbsd.bugs |
|---|---|
| Message-ID | <[email protected]> |
Hello,
On Fri, Apr 10, 2026 at 09:56:26AM +0200, Renaud Allard wrote:
</snip>
> Index: sys/net/pf_ioctl.c
> ===================================================================
> --- sys/net/pf_ioctl.c
> +++ sys/net/pf_ioctl.c
> @@ -1576,8 +1576,8 @@ pf_sourcelim_add(const struct pfioc_sour
>
> if (RBT_INSERT(pf_sourcelim_nm_tree,
> &pf_sourcelim_nm_tree_inactive, pfsrlim) != NULL) {
> - RBT_INSERT(pf_sourcelim_nm_tree,
> - &pf_sourcelim_nm_tree_inactive, pfsrlim);
> + RBT_REMOVE(pf_sourcelim_id_tree,
> + &pf_sourcelim_id_tree_inactive, pfsrlim);
> error = EBUSY;
> goto unlock;
> }
> @@ -1590,6 +1590,8 @@ pf_sourcelim_add(const struct pfioc_sour
> return (0);
>
> unlock:
> + if (pfsrlim->pfsrlim_overload.table != NULL)
> + pfr_detach_table(pfsrlim->pfsrlim_overload.table);
> PF_UNLOCK();
> NET_UNLOCK();
> free:
>
the whole diff is OK sashan
thanks and
regards