Page MenuHomeFreeBSD

pf: Improve DIOCADDRULE validation
ClosedPublic

Authored by kp on Apr 22 2020, 7:11 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Mar 21, 2:08 PM
Unknown Object (File)
Feb 20 2024, 8:24 PM
Unknown Object (File)
Feb 17 2024, 11:56 PM
Unknown Object (File)
Dec 31 2023, 2:43 PM
Unknown Object (File)
Dec 20 2023, 4:44 AM
Unknown Object (File)
Oct 12 2023, 10:33 PM
Unknown Object (File)
Jul 28 2023, 3:17 AM
Unknown Object (File)
Jul 27 2023, 3:36 AM

Details

Summary

We expect the addrwrap.p.dyn value to be set to NULL (and assert such),
but do not verify it on input.

Reported-by: syzbot+936a89182e7d8f927de1@syzkaller.appspotmail.com

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

LGTM, please see some comments inline.

sys/netpfil/pf/pf_ioctl.c
1573 ↗(On Diff #70888)

Maybe it's worth considering doing input validation before WLOCK/etc ?

1605 ↗(On Diff #70888)

Nit: worth documenting why we don't want dyn to be set by userland?

This revision is now accepted and ready to land.Apr 29 2020, 7:12 PM

Move the check outside of the lock.

This revision now requires review to proceed.May 1 2020, 12:54 PM
This revision was not accepted when it landed; it landed in state Needs Review.May 3 2020, 4:09 PM
This revision was automatically updated to reflect the committed changes.