Differential D24538

pf: Improve DIOCADDRULE validation
ClosedPublic
Actions

Authored by kp on Apr 22 2020, 7:11 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Fri, Dec 20, 1:32 AM

	Unknown Object (File)
	Mon, Dec 9, 6:52 PM

	Unknown Object (File)
	Tue, Nov 26, 3:02 PM

	Unknown Object (File)
	Mon, Nov 25, 5:28 AM

	Unknown Object (File)
	Nov 1 2024, 2:50 PM

	Unknown Object (File)
	Oct 1 2024, 9:23 PM

	Unknown Object (File)
	Sep 27 2024, 7:42 AM

	Unknown Object (File)
	Sep 22 2024, 11:10 AM

View All 39 Files

Subscribers

Details

Reviewers

Group Reviewers

Commits

rS360609: pf: Improve DIOCADDRULE validation

Summary

We expect the addrwrap.p.dyn value to be set to NULL (and assert such),
but do not verify it on input.

Reported-by: syzbot+936a89182e7d8f927de1@syzkaller.appspotmail.com

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

kp created this revision.Apr 22 2020, 7:11 PM

Herald added subscribers: melifaro, farrokhi. · View Herald TranscriptApr 22 2020, 7:11 PM

Harbormaster completed remote builds in B30669: Diff 70888.Apr 22 2020, 7:11 PM

LGTM, please see some comments inline.

sys/netpfil/pf/pf_ioctl.c
1573 ↗	(On Diff #70888)	Maybe it's worth considering doing input validation before WLOCK/etc ?
1605 ↗	(On Diff #70888)	Nit: worth documenting why we don't want dyn to be set by userland?

This revision is now accepted and ready to land.Apr 29 2020, 7:12 PM

Move the check outside of the lock.

This revision now requires review to proceed.May 1 2020, 12:54 PM

Harbormaster completed remote builds in B30840: Diff 71238.May 1 2020, 12:54 PM

This revision was not accepted when it landed; it landed in state Needs Review.May 3 2020, 4:09 PM

Closed by commit rS360609: pf: Improve DIOCADDRULE validation (authored by kp). · Explain Why

This revision was automatically updated to reflect the committed changes.

kp added a commit: rS360609: pf: Improve DIOCADDRULE validation.

Herald added a subscriber: imp. · View Herald TranscriptMay 3 2020, 4:09 PM

Revision Contents
Changeset List

Path

Size

head/

sys/

netpfil/

pf/

5 lines

Diff 71336

head/sys/netpfil/pf/pf_ioctl.c

Loading...