Page MenuHomeFreeBSD

pfil: PFIL_PASS never frees the mbuf
ClosedPublic

Authored by kp on Jan 26 2024, 2:45 PM.
Tags
None
Referenced Files
F132342916: D43617.id133401.diff
Thu, Oct 16, 2:05 AM
Unknown Object (File)
Tue, Oct 14, 10:28 PM
Unknown Object (File)
Mon, Oct 13, 7:37 AM
Unknown Object (File)
Mon, Oct 13, 5:18 AM
Unknown Object (File)
Thu, Oct 9, 1:54 AM
Unknown Object (File)
Wed, Oct 8, 12:17 AM
Unknown Object (File)
Sep 11 2025, 4:09 PM
Unknown Object (File)
Aug 24 2025, 1:21 AM

Details

Summary

pfil hooks (i.e. firewalls) may pass, modify or free the mbuf passed
to them. (E.g. when rejecting a packet, or when gathering up packets
for reassembly).

If the hook returns PFIL_PASS the mbuf must still be present. Assert
this in pfil_mem_common() and ensure that ipfilter follows this
convention. pf and ipfw already did.
Similarly, if the hook returns PFIL_DROPPED or PFIL_CONSUMED the mbuf
must have been freed (or now be owned by the firewall for further
processing, like packet scheduling or reassembly).

This allows us to remove a few extraneous NULL checks.

Suggested by: tuexen
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable