HomeFreeBSD

pf: fix possibe SCTP panic

Description

pf: fix possibe SCTP panic

While processing SCTP packets we can enqueue work for later, in the
sctp_multihome_jobs queue. This deferred job includes a copy of the current
struct pf_pdesc, which must contain a valid pcksum pointer (in case of NAT).

However, jobs could be enqueued before we'd actually set this pointer in
pf_setup_pdesc(). Set this pointer before we scan the SCTP chunk headers (and
could enqueue deferred jobs.)

While here sprinkle in a few more assertions to ensure we got this right.

Reported-by: syzbot+974d0fb7e53c9aa31b90@syzkaller.appspotmail.com
MFC after: 3 days
Sponsored by: Rubicon Communications, LLC ("Netgate")

Details

Provenance
kpAuthored on Thu, Oct 2, 2:48 PM
Parents
rGeee36ffa0d87: ipfilter/ippool: Dump a copy of ippool dstlist data in "new" format
Branches
Unknown
Tags
Unknown