The branch releng/14.0 has been updated by bz:
URL:
https://cgit.FreeBSD.org/src/commit/?id=41023d85b3bc43cb421f46bb35cf75201542c528
commit 41023d85b3bc43cb421f46bb35cf75201542c528
Author: Bjoern A. Zeeb <b...@freebsd.org>
AuthorDate: 2023-09-30 15:11:57 +0000
Commit: Bjoern A. Zeeb <b...@freebsd.org>
CommitDate: 2023-10-10 14:33:37 +0000
netlink: fix accessing freed memory
The check for if_addrlen in dump_iface() is not sufficient to determine
if we still have a valid if_addr. Rather than directly accessing if_addr
check the STAILQ (for the first entry).
This avoids panics when destroying cloned interfaces as experienced with
net80211 wlan ones.
Sponsored by: The FreeBSD Foundation
Approved by: re (gjb)
Reviewed by: jhibbits (earlier version), kp
Differential Revision: https://reviews.freebsd.org/D42027
(cherry picked from commit 7d48224073ce14f0dd3db2d4e96876ac928b52f2)
(cherry picked from commit 8bda9f9c56a997d851e8fc2c20b5e37f072ecb4a)
---
sys/netlink/route/iface.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/sys/netlink/route/iface.c b/sys/netlink/route/iface.c
index e1939c7681de..b6e120933f83 100644
--- a/sys/netlink/route/iface.c
+++ b/sys/netlink/route/iface.c
@@ -292,6 +292,7 @@ static bool
dump_iface(struct nl_writer *nw, if_t ifp, const struct nlmsghdr *hdr,
int if_flags_mask)
{
+ struct epoch_tracker et;
struct ifinfomsg *ifinfo;
NL_LOG(LOG_DEBUG3, "dumping interface %s data", if_name(ifp));
@@ -321,11 +322,15 @@ dump_iface(struct nl_writer *nw, if_t ifp, const struct
nlmsghdr *hdr,
nlattr_add_u8(nw, IFLA_PROTO_DOWN, val);
nlattr_add_u8(nw, IFLA_LINKMODE, val);
*/
- if (if_getaddrlen(ifp) != 0) {
- struct ifaddr *ifa = if_getifaddr(ifp);
+ if (if_getaddrlen(ifp) != 0) {
+ struct ifaddr *ifa;
- dump_sa(nw, IFLA_ADDRESS, ifa->ifa_addr);
- }
+ NET_EPOCH_ENTER(et);
+ ifa = CK_STAILQ_FIRST(&ifp->if_addrhead);
+ if (ifa != NULL)
+ dump_sa(nw, IFLA_ADDRESS, ifa->ifa_addr);
+ NET_EPOCH_EXIT(et);
+ }
if ((if_getbroadcastaddr(ifp) != NULL)) {
nlattr_add(nw, IFLA_BROADCAST, if_getaddrlen(ifp),
