git: 5324cf4f1cf9 - stable/13 - pf: fix sctp deadlock

From: Kristof Provost <kp_at_FreeBSD.org>
Date: Wed, 17 Jul 2024 21:55:27 UTC
The branch stable/13 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=5324cf4f1cf9d93351f966d4a76cf0389d08f3c6

commit 5324cf4f1cf9d93351f966d4a76cf0389d08f3c6
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-07-09 18:49:49 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-07-17 21:54:35 +0000

    pf: fix sctp deadlock
    
    It is possible for pf_test_state_sctp() to find a state and still return
    PF_DROP (or not PF_PASS, to be exact). In that case we would run pf_test_rule()
    unconditionally, but this would overwrite the (locked!) state pointer
    pf_test_state_sctp() gave us. As a result we will later deadlock, trying the
    lock the already locked state.
    
    Do what we do for UDP and TCP, and explicitly check s for NULL before we run
    pf_test_rule().
    
    MFC after:      1 week
    Sponsored by:   Orange Business Services
    
    (cherry picked from commit a9639adaedb4d67340c4ae386fe8fcd18e4a8a21)
---
 sys/netpfil/pf/pf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 97ae44cff69f..e99886a2d120 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -7310,7 +7310,7 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *
 				V_pfsync_update_state_ptr(s);
 			r = s->rule.ptr;
 			a = s->anchor.ptr;
-		} else {
+		} else if (s == NULL) {
 			action = pf_test_rule(&r, &s, pd.dir, kif, m, off,
 			    &pd, &a, &ruleset, inp);
 		}
@@ -7838,7 +7838,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb
 				V_pfsync_update_state_ptr(s);
 			r = s->rule.ptr;
 			a = s->anchor.ptr;
-		} else {
+		} else if (s == NULL) {
 			action = pf_test_rule(&r, &s, pd.dir, kif, m, off,
 			    &pd, &a, &ruleset, inp);
 		}