The branch main has been updated by kp:
URL:
https://cgit.FreeBSD.org/src/commit/?id=b01cad6d3a8523101e7915809144f47e3045067f
commit b01cad6d3a8523101e7915809144f47e3045067f
Author: Kristof Provost <k...@freebsd.org>
AuthorDate: 2023-11-22 13:44:03 +0000
Commit: Kristof Provost <k...@freebsd.org>
CommitDate: 2023-11-22 13:47:14 +0000
ip_mroute: handle V_mfchashtbl allocation failure
We allocate V_mfchashtbl with HASH_NOWAIT (which maps to M_NOWAIT), so
this allocation may fail. As we didn't handle that failure we could end
up dereferencing a NULL pointer later (e.g. during X_ip_mrouter_done()).
Do the obvious thing and fail out if we cannot allocate the table.
See also: https://redmine.pfsense.org/issues/14917
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
sys/netinet/ip_mroute.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/sys/netinet/ip_mroute.c b/sys/netinet/ip_mroute.c
index cda5f160e8fb..f789c6eed835 100644
--- a/sys/netinet/ip_mroute.c
+++ b/sys/netinet/ip_mroute.c
@@ -708,6 +708,10 @@ ip_mrouter_init(struct socket *so, int version)
V_mfchashtbl = hashinit_flags(mfchashsize, M_MRTABLE, &V_mfchash,
HASH_NOWAIT);
+ if (V_mfchashtbl == NULL) {
+ MRW_WUNLOCK();
+ return (ENOMEM);
+ }
/* Create upcall ring */
mtx_init(&V_bw_upcalls_ring_mtx, "mroute upcall buf_ring mtx", NULL,
MTX_DEF);
