svn commit: r316809 - head/sys/contrib/ipfilter/netinet

[Cy Schubert]

Author: cy
Date: Fri Apr 14 03:54:36 2017
New Revision: 316809
URL: https://svnweb.freebsd.org/changeset/base/316809

Log:
  Fix a use after free panic in ipfilter's fragment processing.
  Memory is malloc'd, then a search for a match in the fragment table
  is made and if the fragment matches, the wrong fragment table is
  freed, causing a use after free panic. This commit fixes this.
  
  A symptom of the problem is a kernel page fault in bcopy() called by
  ipf_frag_lookup() at line 715 in ip_frag.c. Another symptom is a
  kernel page fault in ipf_frag_delete() when called by ipf_frag_expire()
  via ipf_slowtimer().
  
  MFC after:	1 week

Modified:
  head/sys/contrib/ipfilter/netinet/ip_frag.c

Modified: head/sys/contrib/ipfilter/netinet/ip_frag.c
==============================================================================
--- head/sys/contrib/ipfilter/netinet/ip_frag.c	Fri Apr 14 03:23:03 2017	(r316808)
+++ head/sys/contrib/ipfilter/netinet/ip_frag.c	Fri Apr 14 03:54:36 2017	(r316809)
@@ -474,7 +474,7 @@ ipfr_frag_new(softc, softf, fin, pass, t
 			  IPFR_CMPSZ)) {
 			RWLOCK_EXIT(lock);
 			FBUMPD(ifs_exists);
-			KFREE(fra);
+			KFREE(fran);
 			return NULL;
 		}