[Bug 235097] ci runs panic with use-after-free when running sys/netpfil/pf/nat tests

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=235097

--- Comment #16 from Kristof Provost <kp at freebsd.org> ---
(In reply to Andrey V. Elsukov from comment #14)
> ifa_free() does not free the memory immediately, so it is safe to make access to ifp->if_addr while you are in NET_EPOCH() section.

Right, but if ifa_free() queues the release to happen after everyone who might
be using it has left the NET_EPOCH() section we can still have the pointer to a
freed structure around if we don't NULL out the if_addr pointer.

The problem is that there are two pointers to the struct ifaddr. We remove one
(from the if_addrhead list), but keep the other one around.

-- 
You are receiving this mail because:
You are the assignee for the bug.