| 79f7745c | 02-Feb-2023 |
Cy Schubert <[email protected]> |
ipfilter: Fix use after free on packet with broken lengths
Under the scenario with a packet with length of 67 bytes, a header length
using the default of 20 bytes and a TCP data offset (th_off) of 4
ipfilter: Fix use after free on packet with broken lengths
Under the scenario with a packet with length of 67 bytes, a header length
using the default of 20 bytes and a TCP data offset (th_off) of 48 will
cause m_pullup() to fail to make sure bytes are arragned contiguously.
m_pullup() will free the mbuf chain and return a null. ipfilter stores
the resultant mbuf address (or the resulting NULL) in its fr_info_t
structure. Unfortuntely the eroneous packet is not flagged for drop.
This results in a kernel page fault at line 410 of sys/netinet/ip_fastfwd.c
as it tries to use a now previously freed, by m_pullup(), mbuf.
PR: 266442
Reported by: Robert Morris <[email protected]>
MFC after: 1 week
show more ...
|
| 1f7a710a | 06-Sep-2022 |
Cy Schubert <[email protected]> |
ipfilter: Remove unused ioctl
The SIOCSTAT1 ioctl is only used in ip_auth and is unused in ip_state.
The ip_state version was likely added to support a new statistic yet
to be developed in ipfstat(8
ipfilter: Remove unused ioctl
The SIOCSTAT1 ioctl is only used in ip_auth and is unused in ip_state.
The ip_state version was likely added to support a new statistic yet
to be developed in ipfstat(8) or for some sample userspace application
(similar in fashion to the sample provided for authentication rules).
There is no need to report individual state hash table bucket lengths
to any future userspace application.
If needed for any future debugging purposes a DTrace probe would be a
better vehicle.
This unused ioctl in ip_stat results in a panic.
PR: 266124
Reported by: Robert Morris <[email protected]>
MFC after: 3 days
show more ...
|