From nobody Tue Sep 29 00:04:17 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4htz1f6jzkz6t2mM for ; Tue, 29 Sep 2026 00:04:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4htz1f4S8Hz4R6m for ; Tue, 29 Sep 2026 00:04:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790640262; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Baxr5Z9y1FbeNIKV89ruFMQOa88PJgTkIQKgCAax8ME=; b=MfUXQllE6vIOHIKvKqXZrGVhU8R8P+fn9BA2cmn/6lxDuPVg5WETX1DrG3FpQG8Fn3br60 IR40RsBNFlK52NBlTPdNC/yqA29s1V3B7a/FZ8dqYVutacTY8mKJmOoDkC2LwjLTS7KRwM fxmOYsiEVM2W3PqYp0CpKzoK52l2PKRbZAABh6lT9lwe6rm1X/zxRpO7QX7cdQlvSksJm1 ChMyrmAj8DoYGo7dfn8khX+DIBJVpLBJeON3pWux0ziy03d7saS0sxeny4d2Tn7u9WanK6 qNo2gQ0PEN8hzYwj5SVUPnsz3XD0OL3SGySXmhRTpCeHFR6YvnqojCtI28UY0g== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790640262; b=rP087j1ks6hAb1HOBf+6P+ZBq7cwt91GH1Cj/h7pw/xsgTn1zegJIsuDY7OZ9Y+HjWP8Ho TbyDEtiUU7rENGxmw6gT2Idf9Kbi8vW0PkiwxehNOK4LD6Xn1QbvsVBWMxw47jcxLCpeVI 3aP0pRLkk4J1ZGAjs1nQipMpr9F70OUa/HQWO76k1rbn03HgyhU11Di2Sd0XFdzDZWHr4H 5RTBQZudFZ+FyKf9RYQvEcWcPBXCHi/qhvgPLVtnVqksDd4WoG6bpgzRWaNjiPyEJHKTbs bPE6ZrBJIDREYDe4uTnoJzvK/jz7nvS+2q+dMThtFp1SsJsrlwAV50YcFw16Xg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790640262; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Baxr5Z9y1FbeNIKV89ruFMQOa88PJgTkIQKgCAax8ME=; b=Iuatf+nKD5hCLLNz+jVctWR4oU2p68iCRjudU4oLGTzH/gvYwhzuWb6OI0cuG+5CdZHEaA C9j3JEYRwn0FXNO1CV3fK1XPN9JbDMtd5Jd/P0RAZNq9frx3/G2rUkmUX+vY9zNqGjXIOc I3HwFOlhAlejVUnjTkJvE/Z21BydnZSG9KjexsAcv/86jyroj0bJYOL6J89xV/J/di81eU YPMMnZRxp1oBd/Akgy0Rk7NnS7Y1KjU9xuhAnHo2cVKEsYc9iTYjraxnBMY3Ox8E2WEmEj SiDnlCg7GYv3NLyaUJssagjgzB9WfJiZVkY01mFKa7+wvYSZNmnVKlfBcukg+w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4htz1f3H7Zzqx1 for ; Tue, 29 Sep 2026 00:04:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 387d3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 29 Sep 2026 00:04:17 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: R. Christian McDonald Subject: git: f084f28a52c5 - main - pf: fix NULL dereference in pfr_set_addrs() with feedback List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: f084f28a52c5fb4557ff0b56e98ca36af3d8eec0 Auto-Submitted: auto-generated Date: Tue, 29 Sep 2026 00:04:17 +0000 Message-Id: <6abb0081.387d3.4bf9f4ca@gitrepo.freebsd.org> The branch main has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=f084f28a52c5fb4557ff0b56e98ca36af3d8eec0 commit f084f28a52c5fb4557ff0b56e98ca36af3d8eec0 Author: R. Christian McDonald AuthorDate: 2026-09-28 23:01:08 +0000 Commit: R. Christian McDonald CommitDate: 2026-09-29 00:02:02 +0000 pf: fix NULL dereference in pfr_set_addrs() with feedback Since DIOCRSETADDRS was converted to netlink, pf_handle_table_set_addrs() calls pfr_set_addrs() with a NULL size2, as the netlink interface has no buffer to return the deleted addresses in. pfr_set_addrs() only checked size2 for NULL at the end of the function; with PFR_FLAG_FEEDBACK set it dereferenced it unconditionally first. pfctl sets PFR_FLAG_FEEDBACK when run with -v, so "pfctl -v -t foo -T replace ..." panicked the kernel with a NULL pointer dereference. To reproduce: pfctl -e pfctl -t foo -T add 192.0.2.1 pfctl -v -t foo -T replace 192.0.2.2 Check size2 for NULL before dereferencing it, as is already done at the end of the function. The per-address feedback for added and changed addresses is still copied back as before; only the list of deleted addresses, which the netlink caller has no room for, is skipped. While here, compare size2 against NULL explicitly in the second check as well, per style(9). Add a regression test. Approved by: kp (mentor) Fixes: 08ed87a4a276 ("pf: convert DIOCRSETADDRS to netlink") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D60096 --- sys/netpfil/pf/pf_table.c | 4 ++-- tests/sys/netpfil/pf/table.sh | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/pf/pf_table.c b/sys/netpfil/pf/pf_table.c index dd670d58359b..d11401b6f5a7 100644 --- a/sys/netpfil/pf/pf_table.c +++ b/sys/netpfil/pf/pf_table.c @@ -464,7 +464,7 @@ _skip: } if (flags & PFR_FLAG_DONE) pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY); - if ((flags & PFR_FLAG_FEEDBACK) && *size2) { + if ((flags & PFR_FLAG_FEEDBACK) && size2 != NULL && *size2) { if (*size2 < size+xdel) { *size2 = size+xdel; senderr(0); @@ -490,7 +490,7 @@ _skip: *ndel = xdel; if (nchange != NULL) *nchange = xchange; - if ((flags & PFR_FLAG_FEEDBACK) && size2) + if ((flags & PFR_FLAG_FEEDBACK) && size2 != NULL) *size2 = size+xdel; pfr_destroy_ktable(tmpkt, 0); return (0); diff --git a/tests/sys/netpfil/pf/table.sh b/tests/sys/netpfil/pf/table.sh index 743bfe08557d..c5c9c45c9d3d 100644 --- a/tests/sys/netpfil/pf/table.sh +++ b/tests/sys/netpfil/pf/table.sh @@ -812,6 +812,39 @@ replace_cleanup() pft_cleanup } +atf_test_case "replace_verbose" "cleanup" +replace_verbose_head() +{ + atf_set descr 'Test table replace command, asked to be verbose' + atf_set require.user root +} + +replace_verbose_body() +{ + pft_init + + vnet_mkjail alcatraz + jexec alcatraz pfctl -e + + pft_set_rules alcatraz \ + "table { 192.0.2.1, 192.0.2.2 }" \ + "pass in from to any" + + # This used to panic: pfr_set_addrs() dereferenced a NULL size2 + # when asked for feedback over netlink. + atf_check -s exit:0 -e "match:1 addresses added." \ + -e "match:1 addresses deleted." \ + jexec alcatraz pfctl -v -t foo -T replace 192.0.2.2 192.0.2.3 + atf_check -s exit:0 -o "match:192.0.2.2" -o "match:192.0.2.3" \ + -o "not-match:192.0.2.1" \ + jexec alcatraz pfctl -t foo -T show +} + +replace_verbose_cleanup() +{ + pft_cleanup +} + atf_test_case "load" "cleanup" load_head() { @@ -902,6 +935,7 @@ atf_init_test_cases() atf_add_test_case "show_recursive" atf_add_test_case "in_anchor" atf_add_test_case "replace" + atf_add_test_case "replace_verbose" atf_add_test_case "load" atf_add_test_case "test" }