From 53f4b0cf9bcbb430fff335c844f11c9fcaacdd33 Mon Sep 17 00:00:00 2001 From: Gleb Smirnoff Date: Fri, 25 Apr 2014 11:36:11 +0000 Subject: [PATCH] The current API for adding rules with pool addresses is the following: - DIOCADDADDR adds addresses and puts them into V_pf_pabuf - DIOCADDRULE takes all addresses from V_pf_pabuf and links them into rule. The ugly part is that if address is a table, then it is initialized in DIOCADDRULE, because we need ruleset, and DIOCADDADDR doesn't supply ruleset. But if address is a dynaddr, we need address family, and address family could be different for different addresses in one rule, so dynaddr is initialized in DIOCADDADDR. This leads to the entangled state of addresses on V_pf_pabuf. Some are initialized, and some not. That's why running pf_empty_pool(&V_pf_pabuf) can lead to a panic on a NULL table address. Since proper fix requires API/ABI change, for now simply plug the panic in pf_empty_pool(). Reported by: danger --- sys/netpfil/pf/pf_ioctl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 9d28d040449..9a5dfcf577e 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -343,7 +343,9 @@ pf_empty_pool(struct pf_palist *poola) pfi_dynaddr_remove(pa->addr.p.dyn); break; case PF_ADDR_TABLE: - pfr_detach_table(pa->addr.p.tbl); + /* XXX: this could be unfinished pooladdr on pabuf */ + if (pa->addr.p.tbl != NULL) + pfr_detach_table(pa->addr.p.tbl); break; } if (pa->kif)