The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=301ec2cebb6a3e472af39eb7b98c3b7ff88e04b0
commit 301ec2cebb6a3e472af39eb7b98c3b7ff88e04b0 Author: Kristof Provost <[email protected]> AuthorDate: 2024-05-06 07:43:49 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2024-05-08 11:19:05 +0000 pf: always mark states as unlinked before detaching them Users have reported crashes in pf_test_state_udp() where at least one state key is NULL. That suggests that pf_detach_state() ran concurrently with pf_test_state_udp(). pf_test_state_udp() holds the state lock (aka the id lock), but pf_detach_state() does not. The intent is that detached states are not returned by STATE_LOOKUP/ pf_find_state(), as the state's timeout is set to PFTM_UNLINKED and thus pf_find_state() does not find the state. There are other paths to pf_detach_state() (outside of pf_unlink_state()) though, where we did not set the timeout to PFTM_UNLINKED. Fix those, and assert that the timeout is set correctly when we enter pf_detach_state(). MFC after: 1 week See also: https://redmine.pfsense.org/issues/15413 Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D45101 --- sys/netpfil/pf/pf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 0dd4da5f271a..195b5d49db7a 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -1353,6 +1353,7 @@ keyattach: sk : NULL); printf("\n"); } + s->timeout = PFTM_UNLINKED; PF_HASHROW_UNLOCK(ih); KEYS_UNLOCK(); uma_zfree(V_pf_state_key_z, sk); @@ -1421,6 +1422,7 @@ pf_detach_state(struct pf_kstate *s) struct pf_keyhash *kh; NET_EPOCH_ASSERT(); + MPASS(s->timeout >= PFTM_MAX); pf_sctp_multihome_detach_addr(s); @@ -1552,6 +1554,7 @@ pf_state_insert(struct pfi_kkif *kif, struct pfi_kkif *orig_kif, break; if (cur != NULL) { + s->timeout = PFTM_UNLINKED; PF_HASHROW_UNLOCK(ih); if (V_pf_status.debug >= PF_DEBUG_MISC) { printf("pf: state ID collision: "
