git: 6f6ca5288060 - stable/14 - pf: fix panic in pf_return()

The branch stable/14 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=6f6ca5288060110c7385b9424e4729b192ed6308

commit 6f6ca5288060110c7385b9424e4729b192ed6308
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2025-06-06 08:16:13 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2025-06-06 08:24:48 +0000

    pf: fix panic in pf_return()
    
    We (correctly) NULL out sk and nk before calling pf_return(), but that
    function still tried to use them to undo NAT transformations.
    
    Store the old port numbers and use those rather than sk/nk.
    
    This is a partial import of e11dacbf8484adc7bbb61b20fee3ab8385745925
    (osport/odport), and the missing parts of
    bdea9cbcf2decafeb4da5a0280313efccc09e1b3.
    
    Direct commit to stable/14.
    
    PR:             287254
---
 sys/net/pfvar.h     |  6 ++++--
 sys/netpfil/pf/pf.c | 31 ++++++++++++++++---------------
 2 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index 2f7e4b913c91..de18ead7281e 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -1559,8 +1559,10 @@ struct pf_pdesc {
 	struct pf_addr	*dst;		/* dst address */
 	struct pf_addr	 osrc;
 	struct pf_addr	 odst;
-	u_int16_t	*sport;
-	u_int16_t	*dport;
+	u_int16_t		*sport;
+	u_int16_t		*dport;
+	u_int16_t		osport;
+	u_int16_t		odport;
 	struct pf_mtag	*pf_mtag;
 	struct pf_rule_actions	act;
 
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 8201d3e24db7..2ba2f2213fb7 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -333,7 +333,7 @@ static int		 pf_create_state(struct pf_krule *, struct pf_krule *,
 			    struct pf_krule *, struct pf_pdesc *,
 			    struct pf_ksrc_node *, struct pf_state_key *,
 			    struct pf_state_key *, struct mbuf *, int,
-			    u_int16_t, u_int16_t, int *, struct pfi_kkif *,
+			    int *, struct pfi_kkif *,
 			    struct pf_kstate **, int, u_int16_t, u_int16_t,
 			    int, struct pf_krule_slist *);
 static int		 pf_state_key_addr_setup(struct pf_pdesc *, struct mbuf *,
@@ -3463,7 +3463,7 @@ pf_send_tcp(const struct pf_krule *r, sa_family_t af,
 
 static void
 pf_return(struct pf_krule *r, struct pf_krule *nr, struct pf_pdesc *pd,
-    struct pf_state_key *sk, int off, struct mbuf *m, struct tcphdr *th,
+    int off, struct mbuf *m, struct tcphdr *th,
     struct pfi_kkif *kif, u_int16_t bproto_sum, u_int16_t bip_sum, int hdrlen,
     u_short *reason, int rtableid)
 {
@@ -3476,9 +3476,9 @@ pf_return(struct pf_krule *r, struct pf_krule *nr, struct pf_pdesc *pd,
 		PF_ACPY(saddr, &pd->osrc, pd->af);
 		PF_ACPY(daddr, &pd->odst, pd->af);
 		if (pd->sport)
-			*pd->sport = sk->port[pd->sidx];
+			*pd->sport = pd->osport;
 		if (pd->dport)
-			*pd->dport = sk->port[pd->didx];
+			*pd->dport = pd->odport;
 		if (pd->proto_sum)
 			*pd->proto_sum = bproto_sum;
 		if (pd->ip_sum)
@@ -4758,6 +4758,9 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
 		break;
 	}
 
+	pd->osport = sport;
+	pd->odport = dport;
+
 	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
 
 	/* check packet for BINAT/NAT/RDR */
@@ -5045,7 +5048,7 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
 	    ((r->rule_flag & PFRULE_RETURNRST) ||
 	    (r->rule_flag & PFRULE_RETURNICMP) ||
 	    (r->rule_flag & PFRULE_RETURN))) {
-		pf_return(r, nr, pd, sk, off, m, th, kif, bproto_sum,
+		pf_return(r, nr, pd, off, m, th, kif, bproto_sum,
 		    bip_sum, hdrlen, &reason, r->rtableid);
 	}
 
@@ -5063,14 +5066,14 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
 	    (pd->flags & PFDESC_TCP_NORM))) {
 		int action;
 		action = pf_create_state(r, nr, a, pd, nsn, nk, sk, m, off,
-		    sport, dport, &rewrite, kif, sm, tag, bproto_sum, bip_sum,
+		    &rewrite, kif, sm, tag, bproto_sum, bip_sum,
 		    hdrlen, &match_rules);
 		sk = nk = NULL;
 		if (action != PF_PASS) {
 			pd->act.log |= PF_LOG_FORCE;
 			if (action == PF_DROP &&
 			    (r->rule_flag & PFRULE_RETURN))
-				pf_return(r, nr, pd, sk, off, m, th, kif,
+				pf_return(r, nr, pd, off, m, th, kif,
 				    bproto_sum, bip_sum, hdrlen, &reason,
 				    pd->act.rtableid);
 			return (action);
@@ -5117,8 +5120,8 @@ cleanup:
 static int
 pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
     struct pf_pdesc *pd, struct pf_ksrc_node *nsn, struct pf_state_key *nk,
-    struct pf_state_key *sk, struct mbuf *m, int off, u_int16_t sport,
-    u_int16_t dport, int *rewrite, struct pfi_kkif *kif, struct pf_kstate **sm,
+    struct pf_state_key *sk, struct mbuf *m, int off,
+    int *rewrite, struct pfi_kkif *kif, struct pf_kstate **sm,
     int tag, u_int16_t bproto_sum, u_int16_t bip_sum, int hdrlen,
     struct pf_krule_slist *match_rules)
 {
@@ -5281,7 +5284,8 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
 	if (nr == NULL) {
 		KASSERT((sk == NULL && nk == NULL), ("%s: nr %p sk %p, nk %p",
 		    __func__, nr, sk, nk));
-		sk = pf_state_key_setup(pd, m, off, pd->src, pd->dst, sport, dport);
+		sk = pf_state_key_setup(pd, m, off, pd->src, pd->dst,
+		    pd->osport, pd->odport);
 		if (sk == NULL)
 			goto csfailed;
 		nk = sk;
@@ -5306,15 +5310,12 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
 		pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_SRC);
 		/* undo NAT changes, if they have taken place */
 		if (nr != NULL) {
-			struct pf_state_key *skt = s->key[PF_SK_WIRE];
-			if (pd->dir == PF_OUT)
-				skt = s->key[PF_SK_STACK];
 			PF_ACPY(pd->src, &pd->osrc, pd->af);
 			PF_ACPY(pd->dst, &pd->odst, pd->af);
 			if (pd->sport)
-				*pd->sport = skt->port[pd->sidx];
+				*pd->sport = pd->osport;
 			if (pd->dport)
-				*pd->dport = skt->port[pd->didx];
+				*pd->dport = pd->odport;
 			if (pd->proto_sum)
 				*pd->proto_sum = bproto_sum;
 			if (pd->ip_sum)