svn commit: r264915 - head/sys/netpfil/pf

Gleb Smirnoff glebius at
Fri Apr 25 11:36:12 UTC 2014

Author: glebius
Date: Fri Apr 25 11:36:11 2014
New Revision: 264915

  The current API for adding rules with pool addresses is the following:
  - DIOCADDADDR adds addresses and puts them into V_pf_pabuf
  - DIOCADDRULE takes all addresses from V_pf_pabuf and links
    them into rule.
  The ugly part is that if address is a table, then it is initialized
  in DIOCADDRULE, because we need ruleset, and DIOCADDADDR doesn't
  supply ruleset. But if address is a dynaddr, we need address family,
  and address family could be different for different addresses in one
  rule, so dynaddr is initialized in DIOCADDADDR.
  This leads to the entangled state of addresses on V_pf_pabuf. Some are
  initialized, and some not. That's why running pf_empty_pool(&V_pf_pabuf)
  can lead to a panic on a NULL table address.
  Since proper fix requires API/ABI change, for now simply plug the panic
  in pf_empty_pool().
  Reported by:	danger


Modified: head/sys/netpfil/pf/pf_ioctl.c
--- head/sys/netpfil/pf/pf_ioctl.c	Fri Apr 25 09:54:42 2014	(r264914)
+++ head/sys/netpfil/pf/pf_ioctl.c	Fri Apr 25 11:36:11 2014	(r264915)
@@ -343,7 +343,9 @@ pf_empty_pool(struct pf_palist *poola)
 		case PF_ADDR_TABLE:
-			pfr_detach_table(pa->addr.p.tbl);
+			/* XXX: this could be unfinished pooladdr on pabuf */
+			if (pa->addr.p.tbl != NULL)
+				pfr_detach_table(pa->addr.p.tbl);
 		if (pa->kif)

More information about the svn-src-head mailing list