Page MenuHomeFreeBSD

ipsec esp: avoid dereferencing freed secasindex
ClosedPublic

Authored by kib on Feb 25 2024, 10:37 AM.
Tags
None
Referenced Files
F97593449: D44079.diff
Mon, Sep 30, 6:11 AM
Unknown Object (File)
Thu, Sep 26, 3:20 AM
Unknown Object (File)
Sat, Sep 21, 4:23 PM
Unknown Object (File)
Sat, Sep 7, 11:41 PM
Unknown Object (File)
Sat, Sep 7, 11:41 PM
Unknown Object (File)
Sat, Sep 7, 11:41 PM
Unknown Object (File)
Sat, Sep 7, 11:41 PM
Unknown Object (File)
Sat, Sep 7, 11:41 PM

Details

Summary
It is possible that SA was removed while processing packed, in which
case it changed to the DEAD state and it index removed from the tree.
Dereferencing sav->sah then touches freed memory.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

kib requested review of this revision.Feb 25 2024, 10:37 AM

Probably we should increase esps_notdb or esps_invalid counter here.

This revision is now accepted and ready to land.Feb 26 2024, 7:40 AM

Update counter, add debug printf for the situation.

This revision now requires review to proceed.Feb 26 2024, 10:04 AM
This revision is now accepted and ready to land.Feb 26 2024, 2:17 PM
This revision was automatically updated to reflect the committed changes.