git: a0c64a443e4c - main - pf: ensure states passed to pf_free_state() are always unlinked

[Kristof Provost]

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=a0c64a443e4cae67a5eea3a61a47d746866de3ee

commit a0c64a443e4cae67a5eea3a61a47d746866de3ee
Author:     Kristof Provost <kp at FreeBSD.org>
AuthorDate: 2021-09-03 07:36:19 +0000
Commit:     Kristof Provost <kp at FreeBSD.org>
CommitDate: 2021-09-03 07:36:19 +0000

    pf: ensure states passed to pf_free_state() are always unlinked
    
    In pf_create_state() we can end up deleting the state immediately. This
    can happen if we fail to map the relevant addresses or fail
    normalization or fail to insert it into the state table.
    If that happens we delete the state again with pf_free_state(). However,
    this asserts that the state must be unlinked.
    
    It's correct to simply set the state to PFTM_UNLINKED because we've not
    yet linked it.
    
    Submitted by:   Mateusz Guzik <mjg at FreeBSD.org>
    Reviewed by:    scottl
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D31752
---
 sys/netpfil/pf/pf.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index c4b29249ca6a..8a81aeb1c010 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -3980,6 +3980,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
 		if (pf_map_addr(pd->af, r, pd->src, &s->rt_addr, NULL, &sn)) {
 			REASON_SET(&reason, PFRES_MAPFAILED);
 			pf_src_tree_remove_state(s);
+			s->timeout = PFTM_UNLINKED;
 			STATE_DEC_COUNTERS(s);
 			pf_free_state(s);
 			goto csfailed;
@@ -4002,6 +4003,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
 		    off, pd, th, &s->src, &s->dst)) {
 			REASON_SET(&reason, PFRES_MEMORY);
 			pf_src_tree_remove_state(s);
+			s->timeout = PFTM_UNLINKED;
 			STATE_DEC_COUNTERS(s);
 			pf_free_state(s);
 			return (PF_DROP);
@@ -4014,6 +4016,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
 			    ("pf_normalize_tcp_stateful failed on first "
 			     "pkt\n"));
 			pf_src_tree_remove_state(s);
+			s->timeout = PFTM_UNLINKED;
 			STATE_DEC_COUNTERS(s);
 			pf_free_state(s);
 			return (PF_DROP);
@@ -4041,6 +4044,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
 	    (pd->dir == PF_IN) ? nk : sk, s)) {
 		REASON_SET(&reason, PFRES_STATEINS);
 		pf_src_tree_remove_state(s);
+		s->timeout = PFTM_UNLINKED;
 		STATE_DEC_COUNTERS(s);
 		pf_free_state(s);
 		return (PF_DROP);