Paths

Table of Contentst

ipsec esp: avoid dereferencing freed secasindex
ClosedPublic
Actions

Authored by kib on Feb 25 2024, 10:37 AM.

Tags

None

Referenced Files

	Unknown Object (File)
	Tue, May 12, 11:08 PM

	Unknown Object (File)
	Apr 27 2026, 3:15 PM

	Unknown Object (File)
	Apr 19 2026, 1:54 PM

	Unknown Object (File)
	Apr 19 2026, 10:30 AM

	Unknown Object (File)
	Apr 19 2026, 6:10 AM

	Unknown Object (File)
	Apr 19 2026, 5:56 AM

	Unknown Object (File)
	Apr 18 2026, 7:45 PM

	Unknown Object (File)
	Apr 17 2026, 11:40 PM

Subscribers

Details

Reviewers

ae
jhb

Commits

rG1a56620b7958: ipsec esp: avoid dereferencing freed secasindex

Summary

It is possible that SA was removed while processing packed, in which
case it changed to the DEAD state and it index removed from the tree.
Dereferencing sav->sah then touches freed memory.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

kib created this revision.Feb 25 2024, 10:37 AM

Herald added subscribers: glebius, melifaro, imp. · View Herald TranscriptFeb 25 2024, 10:37 AM

kib requested review of this revision.Feb 25 2024, 10:37 AM

Probably we should increase esps_notdb or esps_invalid counter here.

This revision is now accepted and ready to land.Feb 26 2024, 7:40 AM

Update counter, add debug printf for the situation.

This revision now requires review to proceed.Feb 26 2024, 10:04 AM

ae accepted this revision.Feb 26 2024, 2:17 PM

This revision is now accepted and ready to land.Feb 26 2024, 2:17 PM

Closed by commit rG1a56620b7958: ipsec esp: avoid dereferencing freed secasindex (authored by kib). · Explain WhyFeb 26 2024, 2:28 PM

This revision was automatically updated to reflect the committed changes.

kib added a commit: rG1a56620b7958: ipsec esp: avoid dereferencing freed secasindex.

Revision Contents
Changeset List

Path

Size

sys/

netipsec/

xform_esp.c

7 lines

Diff 135004

View Options

ipsec esp: avoid dereferencing freed secasindexClosedPublicActions