Author: kp
Date: Thu Mar 9 03:20:20 2017
New Revision: 314940
URL: https://svnweb.freebsd.org/changeset/base/314940
Log:
MFC r314810:
pf: Fix a crash in low-memory situations
If the call to pf_state_key_clone() in pf_get_translation() fails (i.e.
there's
no more memory for it) it frees skp. This is wrong, because skp is a
pf_state_key **, so we need to free *skp, as is done later in the function.
Getting it wrong means we try to free a stack variable of the calling
pf_test_rule() function, and we panic.
Modified:
stable/10/sys/netpfil/pf/pf_lb.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/sys/netpfil/pf/pf_lb.c
==============================================================================
--- stable/10/sys/netpfil/pf/pf_lb.c Thu Mar 9 02:59:02 2017
(r314939)
+++ stable/10/sys/netpfil/pf/pf_lb.c Thu Mar 9 03:20:20 2017
(r314940)
@@ -550,7 +550,7 @@ pf_get_translation(struct pf_pdesc *pd,
return (NULL);
*nkp = pf_state_key_clone(*skp);
if (*nkp == NULL) {
- uma_zfree(V_pf_state_key_z, skp);
+ uma_zfree(V_pf_state_key_z, *skp);
*skp = NULL;
return (NULL);
}
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
