Page MenuHomeFreeBSD

ipsec: plug use-after-free of SAH
AbandonedPublic

Authored by mjg on Sep 9 2022, 8:11 PM.
Tags
None
Referenced Files
F108298373: D36510.diff
Thu, Jan 23, 4:07 PM
F108284805: D36510.diff
Thu, Jan 23, 12:27 PM
Unknown Object (File)
Tue, Jan 21, 5:05 AM
Unknown Object (File)
Sat, Jan 18, 11:49 AM
Unknown Object (File)
Thu, Jan 16, 7:53 PM
Unknown Object (File)
Dec 12 2024, 11:43 AM
Unknown Object (File)
Dec 9 2024, 3:43 AM
Unknown Object (File)
Nov 25 2024, 4:07 AM
Subscribers

Details

Reviewers
ae
Group Reviewers
network
Summary
Change refcounting scheme to a more idiomatic approach: every
secasvar object keeps a ref to SAH which is only released when
the object goes away.

Plugs panics of the form:
panic: esp_input_cb: Unexpected address family: 0 saidx=0xfffffd001832a330

I validated this is the issue by neglecting to actually free anything on stock kernel and instead poisoning address family with a dedicated value, which did start showing up.

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

mjg requested review of this revision.Sep 9 2022, 8:11 PM
mjg edited the summary of this revision. (Show Details)

I'll try to read the patch more carefully this weekend.

sys/netipsec/key.c
1371

The comment become stale.

5282

another stale comment.