From b01cad6d3a8523101e7915809144f47e3045067f Mon Sep 17 00:00:00 2001 From: Kristof Provost Date: Wed, 22 Nov 2023 14:44:03 +0100 Subject: [PATCH] ip_mroute: handle V_mfchashtbl allocation failure We allocate V_mfchashtbl with HASH_NOWAIT (which maps to M_NOWAIT), so this allocation may fail. As we didn't handle that failure we could end up dereferencing a NULL pointer later (e.g. during X_ip_mrouter_done()). Do the obvious thing and fail out if we cannot allocate the table. See also: https://redmine.pfsense.org/issues/14917 Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netinet/ip_mroute.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sys/netinet/ip_mroute.c b/sys/netinet/ip_mroute.c index cda5f160e8f..f789c6eed83 100644 --- a/sys/netinet/ip_mroute.c +++ b/sys/netinet/ip_mroute.c @@ -708,6 +708,10 @@ ip_mrouter_init(struct socket *so, int version) V_mfchashtbl = hashinit_flags(mfchashsize, M_MRTABLE, &V_mfchash, HASH_NOWAIT); + if (V_mfchashtbl == NULL) { + MRW_WUNLOCK(); + return (ENOMEM); + } /* Create upcall ring */ mtx_init(&V_bw_upcalls_ring_mtx, "mroute upcall buf_ring mtx", NULL, MTX_DEF);