From nobody Tue Sep 29 00:04:17 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4htz1Y4hgMz6t39h for ; Tue, 29 Sep 2026 00:04:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4htz1Y4715z4QdN for ; Tue, 29 Sep 2026 00:04:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790640257; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Baxr5Z9y1FbeNIKV89ruFMQOa88PJgTkIQKgCAax8ME=; b=QHYu5KOgGkf3Ndtzt/W0hCSm6k7fyEdm7wbZxWEzvw68YNQ0Kpfjo3j6CxVXOi5zzp2ZhF f9jdIQAWexfIpellVLNviY3bwRrZzCF8vETrm/PzFk6ja34nRroaIS5kDHIPSQrMjybmq3 qIF8k3hIlVDE+8qOVcpzrd1cAXr7F0KLIkoh2sJxJiZ4u4LInTd2zU7leJpKwQ1hRe8zpv JWP32b0s+wbQAgOxldroPQl5wYWi715fEaGNNY3ni/GC7Mgw0f5ptccAh+8r4qsrmdbYvy bPxq9Lm5SsdZlrpWF/dQziKI6h8xzt/yu2pqFNfJ14YIdCu6aBkgt8EScSMQVg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790640257; b=fGvpHHYAYh6k5TjUfD3zDmWcEYQqGg22enE1bz10ualzChgiFA65WQ1kMihxeCXZxAM62y FvVx1hOYwLcmHb+nGCnfCciUBuZizK4W5PQqnQPLURYavV5zJltI/BNHPNIbu6o+NRh/8N Iph1cbKaM/Q5uaBsrpKqNVT29XwDRVAVBEVeCIHEWLfBQJp8rXUZjXvjfsMH7aJNSOrZqq nbdXhoGDdlTboodTAIah0NRPKxk2LZUdMMSfZ2oESGiHP9feqgzjJu/psVLzRyIaBosGR9 kKhnYLSwFNdbIPXJiC5GRaQXfhf0ndfXzSirhaIasO0TTctpSqAOtX1A3OEJFw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790640257; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Baxr5Z9y1FbeNIKV89ruFMQOa88PJgTkIQKgCAax8ME=; b=GSRdljv7Hic1BELux9g44rUm1q5htaPbqLXT3U/TKm7z0Zc2rP84D5etNlUzw/y67P4Z4k gIYdEE92JJ9oCAC0KYrsY40HQ+lPKtISFTgB2i/nCnkfiqVA23s8HpVmKIV8/ir+fYlyZK oHYdPEw4Nkb8BkQcSv9fx2xm8JTj+fO2RIHtdtRcjuVN9ZvVXuhgXbnBG84at+qHLN2ma9 xOALQ4j4Eq6PGCzy5JtNsM2NWOFmdJzdZcTY0iQ2rrauucBoHGMzMwR86qXx9kMjMGmr03 KDKz+NZmJtSXjHb6LBEvGYDOom7YCyi+up0YTn347r9pLjKCYc+YUcXBRbxc5w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4htz1Y2WH3zqg1 for ; Tue, 29 Sep 2026 00:04:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 387d3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 29 Sep 2026 00:04:17 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: R. Christian McDonald Subject: git: f084f28a52c5 - main - pf: fix NULL dereference in pfr_set_addrs() with feedback List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: f084f28a52c5fb4557ff0b56e98ca36af3d8eec0 Auto-Submitted: auto-generated Date: Tue, 29 Sep 2026 00:04:17 +0000 Message-Id: <6abb0081.387d3.4bf9f4ca@gitrepo.freebsd.org> The branch main has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=f084f28a52c5fb4557ff0b56e98ca36af3d8eec0 commit f084f28a52c5fb4557ff0b56e98ca36af3d8eec0 Author: R. Christian McDonald AuthorDate: 2026-09-28 23:01:08 +0000 Commit: R. Christian McDonald CommitDate: 2026-09-29 00:02:02 +0000 pf: fix NULL dereference in pfr_set_addrs() with feedback Since DIOCRSETADDRS was converted to netlink, pf_handle_table_set_addrs() calls pfr_set_addrs() with a NULL size2, as the netlink interface has no buffer to return the deleted addresses in. pfr_set_addrs() only checked size2 for NULL at the end of the function; with PFR_FLAG_FEEDBACK set it dereferenced it unconditionally first. pfctl sets PFR_FLAG_FEEDBACK when run with -v, so "pfctl -v -t foo -T replace ..." panicked the kernel with a NULL pointer dereference. To reproduce: pfctl -e pfctl -t foo -T add 192.0.2.1 pfctl -v -t foo -T replace 192.0.2.2 Check size2 for NULL before dereferencing it, as is already done at the end of the function. The per-address feedback for added and changed addresses is still copied back as before; only the list of deleted addresses, which the netlink caller has no room for, is skipped. While here, compare size2 against NULL explicitly in the second check as well, per style(9). Add a regression test. Approved by: kp (mentor) Fixes: 08ed87a4a276 ("pf: convert DIOCRSETADDRS to netlink") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D60096 --- sys/netpfil/pf/pf_table.c | 4 ++-- tests/sys/netpfil/pf/table.sh | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/pf/pf_table.c b/sys/netpfil/pf/pf_table.c index dd670d58359b..d11401b6f5a7 100644 --- a/sys/netpfil/pf/pf_table.c +++ b/sys/netpfil/pf/pf_table.c @@ -464,7 +464,7 @@ _skip: } if (flags & PFR_FLAG_DONE) pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY); - if ((flags & PFR_FLAG_FEEDBACK) && *size2) { + if ((flags & PFR_FLAG_FEEDBACK) && size2 != NULL && *size2) { if (*size2 < size+xdel) { *size2 = size+xdel; senderr(0); @@ -490,7 +490,7 @@ _skip: *ndel = xdel; if (nchange != NULL) *nchange = xchange; - if ((flags & PFR_FLAG_FEEDBACK) && size2) + if ((flags & PFR_FLAG_FEEDBACK) && size2 != NULL) *size2 = size+xdel; pfr_destroy_ktable(tmpkt, 0); return (0); diff --git a/tests/sys/netpfil/pf/table.sh b/tests/sys/netpfil/pf/table.sh index 743bfe08557d..c5c9c45c9d3d 100644 --- a/tests/sys/netpfil/pf/table.sh +++ b/tests/sys/netpfil/pf/table.sh @@ -812,6 +812,39 @@ replace_cleanup() pft_cleanup } +atf_test_case "replace_verbose" "cleanup" +replace_verbose_head() +{ + atf_set descr 'Test table replace command, asked to be verbose' + atf_set require.user root +} + +replace_verbose_body() +{ + pft_init + + vnet_mkjail alcatraz + jexec alcatraz pfctl -e + + pft_set_rules alcatraz \ + "table { 192.0.2.1, 192.0.2.2 }" \ + "pass in from to any" + + # This used to panic: pfr_set_addrs() dereferenced a NULL size2 + # when asked for feedback over netlink. + atf_check -s exit:0 -e "match:1 addresses added." \ + -e "match:1 addresses deleted." \ + jexec alcatraz pfctl -v -t foo -T replace 192.0.2.2 192.0.2.3 + atf_check -s exit:0 -o "match:192.0.2.2" -o "match:192.0.2.3" \ + -o "not-match:192.0.2.1" \ + jexec alcatraz pfctl -t foo -T show +} + +replace_verbose_cleanup() +{ + pft_cleanup +} + atf_test_case "load" "cleanup" load_head() { @@ -902,6 +935,7 @@ atf_init_test_cases() atf_add_test_case "show_recursive" atf_add_test_case "in_anchor" atf_add_test_case "replace" + atf_add_test_case "replace_verbose" atf_add_test_case "load" atf_add_test_case "test" }