Page MenuHomeFreeBSD

ipsec: plug use-after-free of SAH
AbandonedPublic

Authored by mjg on Sep 9 2022, 8:11 PM.
Tags
None
Referenced Files
F103126178: D36510.diff
Thu, Nov 21, 8:37 AM
Unknown Object (File)
Tue, Nov 5, 10:30 AM
Unknown Object (File)
Oct 16 2024, 6:39 PM
Unknown Object (File)
Oct 15 2024, 12:30 AM
Unknown Object (File)
Oct 14 2024, 1:32 PM
Unknown Object (File)
Oct 12 2024, 4:26 PM
Unknown Object (File)
Oct 11 2024, 8:26 AM
Unknown Object (File)
Oct 9 2024, 2:38 PM
Subscribers

Details

Reviewers
ae
Group Reviewers
network
Summary
Change refcounting scheme to a more idiomatic approach: every
secasvar object keeps a ref to SAH which is only released when
the object goes away.

Plugs panics of the form:
panic: esp_input_cb: Unexpected address family: 0 saidx=0xfffffd001832a330

I validated this is the issue by neglecting to actually free anything on stock kernel and instead poisoning address family with a dedicated value, which did start showing up.

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

mjg requested review of this revision.Sep 9 2022, 8:11 PM
mjg edited the summary of this revision. (Show Details)

I'll try to read the patch more carefully this weekend.

sys/netipsec/key.c
1371

The comment become stale.

5282

another stale comment.