CVS commit: src/sys/net/npf

["Maxime Villard" <maxv%netbsd.org@localhost>]

Module Name:    src
Committed By:   maxv
Date:           Thu Mar 22 07:32:07 UTC 2018

Modified Files:
        src/sys/net/npf: npf_alg_icmp.c

Log Message:
Fix use-after-free.

The nbuf can be reallocated as a result of caching 'enpc', so it is
necessary to recache 'npc', otherwise it contains pointers to the freed
mbuf - pointers which are then used in the ruleset machinery.

We recache 'npc' when we are sure we won't use 'enpc' anymore, because
'enpc' can be clobbered as a result of caching 'npc' (in other words,
only one of the two can be cached at the same time).

Also, we recache 'npc' unconditionally, because there is no way to know
whether the nbuf got clobbered relatively to it. We can't use the
NBUF_DATAREF_RESET flag, because it is stored in the nbuf and not in the
cache.

Discussed with rmind@.


To generate a diff of this commit:
cvs rdiff -u -r1.26 -r1.27 src/sys/net/npf/npf_alg_icmp.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.