git: 8b9d1dc82ac4 - stable/14 - pf: don't use state keys after pf_state_insert()

The branch stable/14 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=8b9d1dc82ac420ee1c1f524861affef59c4d5ba7

commit 8b9d1dc82ac420ee1c1f524861affef59c4d5ba7
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2025-03-27 14:35:40 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2025-04-21 20:25:45 +0000

    pf: don't use state keys after pf_state_insert()
    
    pf_state_insert() may free the state keys, it's not safe to access these
    pointers after the call.
    
    Introduce osrc/odst (similar to osport/odport) to store the original source and
    destination addresses. This allows us to undo NAT transformations without having
    to access the state keys.
    
    Reviewed by:    glebius, markj
    MFC after:      3 weeks
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D49551
    
    (cherry picked from commit bdea9cbcf2decafeb4da5a0280313efccc09e1b3)
---
 sys/net/pfvar.h     |  6 ++++--
 sys/netpfil/pf/pf.c | 12 ++++++++----
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index 949cb36ee474..2f7e4b913c91 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -1557,8 +1557,10 @@ struct pf_pdesc {
 	struct pf_krule	*nat_rule;	/* nat/rdr rule applied to packet */
 	struct pf_addr	*src;		/* src address */
 	struct pf_addr	*dst;		/* dst address */
-	u_int16_t *sport;
-	u_int16_t *dport;
+	struct pf_addr	 osrc;
+	struct pf_addr	 odst;
+	u_int16_t	*sport;
+	u_int16_t	*dport;
 	struct pf_mtag	*pf_mtag;
 	struct pf_rule_actions	act;
 
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index c962821b8acd..c74d2f5efadb 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -3472,8 +3472,8 @@ pf_return(struct pf_krule *r, struct pf_krule *nr, struct pf_pdesc *pd,
 
 	/* undo NAT changes, if they have taken place */
 	if (nr != NULL) {
-		PF_ACPY(saddr, &sk->addr[pd->sidx], af);
-		PF_ACPY(daddr, &sk->addr[pd->didx], af);
+		PF_ACPY(saddr, &pd->osrc, pd->af);
+		PF_ACPY(daddr, &pd->odst, pd->af);
 		if (pd->sport)
 			*pd->sport = sk->port[pd->sidx];
 		if (pd->dport)
@@ -5305,8 +5305,8 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
 			struct pf_state_key *skt = s->key[PF_SK_WIRE];
 			if (pd->dir == PF_OUT)
 				skt = s->key[PF_SK_STACK];
-			PF_ACPY(pd->src, &skt->addr[pd->sidx], pd->af);
-			PF_ACPY(pd->dst, &skt->addr[pd->didx], pd->af);
+			PF_ACPY(pd->src, &pd->osrc, pd->af);
+			PF_ACPY(pd->dst, &pd->odst, pd->af);
 			if (pd->sport)
 				*pd->sport = skt->port[pd->sidx];
 			if (pd->dport)
@@ -8501,6 +8501,8 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
 
 	pd.src = (struct pf_addr *)&h->ip_src;
 	pd.dst = (struct pf_addr *)&h->ip_dst;
+	PF_ACPY(&pd.osrc, pd.src, pd.af);
+	PF_ACPY(&pd.odst, pd.dst, pd.af);
 	pd.ip_sum = &h->ip_sum;
 	pd.proto = h->ip_p;
 	pd.tos = h->ip_tos & ~IPTOS_ECN_MASK;
@@ -9052,6 +9054,8 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb
 
 	pd.src = (struct pf_addr *)&h->ip6_src;
 	pd.dst = (struct pf_addr *)&h->ip6_dst;
+	PF_ACPY(&pd.osrc, pd.src, pd.af);
+	PF_ACPY(&pd.odst, pd.dst, pd.af);
 	pd.tos = IPV6_DSCP(h);
 	pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);