Page MenuHomeFreeBSD

ipsec: plug use-after-free of SAH
Needs ReviewPublic

Authored by mjg on Sep 9 2022, 8:11 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Jan 28, 12:23 PM
Unknown Object (File)
Fri, Jan 13, 6:43 AM
Unknown Object (File)
Dec 14 2022, 2:13 AM
Unknown Object (File)
Nov 29 2022, 2:49 AM
Subscribers

Details

Reviewers
ae
Group Reviewers
network
Summary
Change refcounting scheme to a more idiomatic approach: every
secasvar object keeps a ref to SAH which is only released when
the object goes away.

Plugs panics of the form:
panic: esp_input_cb: Unexpected address family: 0 saidx=0xfffffd001832a330

I validated this is the issue by neglecting to actually free anything on stock kernel and instead poisoning address family with a dedicated value, which did start showing up.

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

mjg requested review of this revision.Sep 9 2022, 8:11 PM
mjg edited the summary of this revision. (Show Details)

I'll try to read the patch more carefully this weekend.

sys/netipsec/key.c
1371

The comment become stale.

5282

another stale comment.