Page MenuHomeFreeBSD
Differential D3037

Avoid double reference decrement when firewalls force relooping of packets
ClosedPublic
Actions

Authored by eri on Jul 9 2015, 12:14 PM.
Tags
Referenced Files
F106074966: D3037.diff
Tue, Dec 24, 11:36 PM
Unknown Object (File)
Tue, Dec 10, 8:56 AM
Unknown Object (File)
Thu, Nov 28, 8:49 PM
Unknown Object (File)
Thu, Nov 28, 8:05 PM
Unknown Object (File)
Oct 7 2024, 2:30 PM
Unknown Object (File)
Oct 4 2024, 2:15 PM
Unknown Object (File)
Oct 3 2024, 11:58 PM
Unknown Object (File)
Oct 1 2024, 4:22 PM
View All 79 Files
Subscribers
imp
network

Details

Reviewers
gnn
rwatson
Commits
rS286037: Avoid double reference decrement when firewalls force relooping of packets
Summary

When firewalls force a reloop of packets and the caller supplied a route the reference to the route might be reduced twice creating issues.
This is especially the scenario when a packet is looped because of operation in the firewall but the new route lookup gives a down route.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

eri updated this revision to Diff 6817.Jul 9 2015, 12:14 PM
eri retitled this revision from to Avoid double reference decrement when firewalls force relooping of packets.
eri updated this object.
eri edited the test plan for this revision. (Show Details)
eri added a reviewer: gnn.
eri set the repository for this revision to rS FreeBSD src repository - subversion.
eri added a project: network.
eri added a subscriber: network.
Herald added a subscriber: imp. · View Herald TranscriptJul 9 2015, 12:14 PM
gnn added a reviewer: rwatson.Jul 24 2015, 1:33 PM
eri added a comment.Jul 24 2015, 5:26 PM

It would be more visible if you take this into consideration https://reviews.freebsd.org/D3022

gnn accepted this revision.Jul 27 2015, 3:08 PM
gnn edited edge metadata.

This is approved for the tree but I would like you to amend this review with a test that we can use to agree that this fix works.

This revision is now accepted and ready to land.Jul 27 2015, 3:08 PM
eri added a comment.Jul 29 2015, 5:54 PM

A test case is for example trying to change the fib to use when forwarding a packet by the firewall.
Also the route need to point to an route that is marked down for some reason...(like interface is not in up state).
Load pf/ipfw and try changing the fib to be used with appropriate rules this will trigger the bug.

Closed by commit rS286037: Avoid double reference decrement when firewalls force relooping of packets (authored by eri). · Explain WhyJul 29 2015, 8:10 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathSize
head/
sys/
netinet/
7 lines

Diff 7482

View Options

head/sys/netinet/ip_output.c

Loading...