ipsec: plug use-after-free of SAH
AbandonedPublic
Actions

Authored by mjg on Sep 9 2022, 8:11 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Fri, Jan 31, 5:17 AM

	Unknown Object (File)
	Thu, Jan 30, 2:14 PM

	Unknown Object (File)
	Thu, Jan 23, 4:07 PM

	Unknown Object (File)
	Thu, Jan 23, 12:27 PM

	Unknown Object (File)
	Tue, Jan 21, 5:05 AM

	Unknown Object (File)
	Sat, Jan 18, 11:49 AM

	Unknown Object (File)
	Thu, Jan 16, 7:53 PM

	Unknown Object (File)
	Dec 12 2024, 11:43 AM

View All 57 Files

Subscribers

glebius

melifaro

Details

Reviewers

Group Reviewers

network

Summary

Change refcounting scheme to a more idiomatic approach: every
secasvar object keeps a ref to SAH which is only released when
the object goes away.

Plugs panics of the form:
panic: esp_input_cb: Unexpected address family: 0 saidx=0xfffffd001832a330

I validated this is the issue by neglecting to actually free anything on stock kernel and instead poisoning address family with a dedicated value, which did start showing up.

Diff Detail

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

mjg created this revision.Sep 9 2022, 8:11 PM

Herald added subscribers: glebius, melifaro. · View Herald TranscriptSep 9 2022, 8:11 PM

mjg requested review of this revision.Sep 9 2022, 8:11 PM

mjg added a reviewer: network.Sep 15 2022, 11:22 PM

mjg edited the summary of this revision. (Show Details)

I'll try to read the patch more carefully this weekend.

sys/netipsec/key.c
1371	The comment become stale.
5282	another stale comment.

mjg abandoned this revision.Mar 12 2024, 10:33 PM

Revision Contents
Changeset List

Path

Size

sys/

netipsec/

key.c

17 lines

Diff 110399

View Options

ipsec: plug use-after-free of SAHAbandonedPublicActions