KekenoBSD/src
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

routing: Fix use-after-free in finalize_nhop

Browse Source 
FIB_NH_LOG calls the `nhop_get_upper_family(nh)` to read
`nh->nh_priv->nh_upper_family` for failure logging.
Call FIB_NH_LOG before freeing nh so failures are logged
without causing a panic.

MFC after: 3 days
This commit is contained in:
Pouria Mousavizadeh Tehrani
2026-04-14 13:06:53 +03:30
parent 439132310a
commit 7d38eb720a
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sys/net/route/nhop_ctl.c
+2 -2
View File
@@ -491,17 +491,17 @@ finalize_nhop(struct nh_control *ctl, struct nhop_object *nh, bool link)
/* Allocate per-cpu packet counter */
nh->nh_pksent = counter_u64_alloc(M_NOWAIT);
if (nh->nh_pksent == NULL) {
FIB_NH_LOG(LOG_WARNING, nh, "counter_u64_alloc() failed");
nhop_free(nh);
RTSTAT_INC(rts_nh_alloc_failure);
FIB_NH_LOG(LOG_WARNING, nh, "counter_u64_alloc() failed");
return (ENOMEM);
}
if (!reference_nhop_deps(nh)) {
FIB_NH_LOG(LOG_WARNING, nh, "interface reference failed");
counter_u64_free(nh->nh_pksent);
nhop_free(nh);
RTSTAT_INC(rts_nh_alloc_failure);
FIB_NH_LOG(LOG_WARNING, nh, "interface reference failed");
return (EAGAIN);
}