svn commit: r285999 - head/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Wed Jul 29 06:35:36 2015
New Revision: 285999
URL: https://svnweb.freebsd.org/changeset/base/285999

Log:
  pf: Always initialise pf_fragment.fr_flags
  
  When we allocate the struct pf_fragment in pf_fillup_fragment() we forgot to
  initialise the fr_flags field. As a result we sometimes mistakenly thought the
  fragment to not be a buffered fragment. This resulted in panics because we'd end
  up freeing the pf_fragment but not removing it from V_pf_fragqueue (believing it
  to be part of V_pf_cachequeue).
  The next time we iterated V_pf_fragqueue we'd use a freed object and panic.
  
  While here also fix a pf_fragment use after free in pf_normalize_ip().
  pf_reassemble() frees the pf_fragment, so we can't use it any more.
  
  PR:		201879, 201932
  MFC after:	5 days

Modified:
  head/sys/netpfil/pf/pf_norm.c

Modified: head/sys/netpfil/pf/pf_norm.c
==============================================================================
--- head/sys/netpfil/pf/pf_norm.c	Wed Jul 29 06:31:44 2015	(r285998)
+++ head/sys/netpfil/pf/pf_norm.c	Wed Jul 29 06:35:36 2015	(r285999)
@@ -431,6 +431,7 @@ pf_fillup_fragment(struct pf_fragment_cm
 		}
 
 		*(struct pf_fragment_cmp *)frag = *key;
+		frag->fr_flags = 0;
 		frag->fr_timeout = time_second;
 		frag->fr_maxlen = frent->fe_len;
 		TAILQ_INIT(&frag->fr_queue);
@@ -1284,9 +1285,6 @@ pf_normalize_ip(struct mbuf **m0, int di
 		if (m == NULL)
 			return (PF_DROP);
 
-		if (frag != NULL && (frag->fr_flags & PFFRAG_DROP))
-			goto drop;
-
 		h = mtod(m, struct ip *);
 	} else {
 		/* non-buffering fragment cache (drops or masks overlaps) */