CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/24 15:53:16
Modified files:
sys/net : pf.c
Log message:
pf(4) yet another race between pf_test() and pf_purge_states()
pf_counters_inc() running on behalf of pf_test() may dereference a
dead memory left behind pf_purge_states(). The reference to state
object is still valid, but other items such as radix tables might
be gone. To stay on the safe side the pf_counters_inc() must
grab state's mutex and check if state itself is on its death
row (->timeout == PFTM_UNLINKED). If it is the case then
pf_counters_inc() must bail out without trying to update counters.
Issue was kindly reported by Acts1631.
OK dlg@
