Bug 255878 - [PATCH] netpfil/ipfw: Fix a double free in aqm_pie_enqueue
Summary: [PATCH] netpfil/ipfw: Fix a double free in aqm_pie_enqueue
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Many People
Assignee: Mark Johnston
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-05-14 14:06 UTC by lylgood
Modified: 2021-05-25 13:29 UTC (History)
2 users (show)

See Also:


Attachments
avoid the double free (436 bytes, patch)
2021-05-14 14:06 UTC, lylgood
no flags Details | Diff
V2: avoid the double free while keep orignal function unchanged (588 bytes, patch)
2021-05-18 03:39 UTC, lylgood
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description lylgood 2021-05-14 14:06:22 UTC
Created attachment 224941 [details]
avoid the double free

Bug File: sys/netpfil/ipfw/dn_aqm_pie.c

In function aqm_pie_enqueue, m is freed via m_freem(m) at line 545.
But the freed m is freed again by FREE_PKT(m) at line 561.

My patch returns the error right away when m_tag_alloc() allocate memory failed, rather than continues to free the m again.
Comment 1 Mark Johnston freebsd_committer freebsd_triage 2021-05-17 18:24:52 UTC
Probably we still want to call update_stats() in the allocation failure case.
Comment 2 lylgood 2021-05-18 03:39:58 UTC
Created attachment 225051 [details]
V2: avoid the double free while keep orignal function unchanged
Comment 3 lylgood 2021-05-18 03:43:20 UTC
(In reply to Mark Johnston from comment #1)

Thanks for your reminder.
I corrected my patch by calling update_stats(q, 0, 1) and reset accu_prob after the allocation failed, to keep the original logic unchanged.

Please review this new patch again.

Thanks.
Comment 4 commit-hook freebsd_committer freebsd_triage 2021-05-18 19:44:52 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=c4a6258d70f73c27d8f0c6233edbcc609791806b

commit c4a6258d70f73c27d8f0c6233edbcc609791806b
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2021-05-18 19:22:21 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2021-05-18 19:25:16 +0000

    dummynet: Fix mbuf tag allocation failure handling

    PR:             255875, 255878, 255879, 255880
    Reviewed by:    donner, kp
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D30318

 sys/netpfil/ipfw/dn_aqm_codel.c      | 4 +---
 sys/netpfil/ipfw/dn_aqm_pie.c        | 6 +++---
 sys/netpfil/ipfw/dn_sched_fq_codel.c | 4 +---
 sys/netpfil/ipfw/dn_sched_fq_pie.c   | 6 +++---
 4 files changed, 8 insertions(+), 12 deletions(-)
Comment 5 commit-hook freebsd_committer freebsd_triage 2021-05-25 13:28:49 UTC
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=b14db362bbd20e5a3d97d121c403b72473fdc733

commit b14db362bbd20e5a3d97d121c403b72473fdc733
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2021-05-18 19:22:21 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2021-05-25 13:26:09 +0000

    dummynet: Fix mbuf tag allocation failure handling

    PR:             255875, 255878, 255879, 255880
    Reviewed by:    donner, kp
    Sponsored by:   The FreeBSD Foundation

    (cherry picked from commit c4a6258d70f73c27d8f0c6233edbcc609791806b)

 sys/netpfil/ipfw/dn_aqm_codel.c      | 4 +---
 sys/netpfil/ipfw/dn_aqm_pie.c        | 6 +++---
 sys/netpfil/ipfw/dn_sched_fq_codel.c | 4 +---
 sys/netpfil/ipfw/dn_sched_fq_pie.c   | 6 +++---
 4 files changed, 8 insertions(+), 12 deletions(-)
Comment 6 commit-hook freebsd_committer freebsd_triage 2021-05-25 13:29:53 UTC
A commit in branch stable/12 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=419a11681c22ce12d3b9a4ab9ab45ff6b7c4ce83

commit 419a11681c22ce12d3b9a4ab9ab45ff6b7c4ce83
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2021-05-18 19:22:21 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2021-05-25 13:29:00 +0000

    dummynet: Fix mbuf tag allocation failure handling

    PR:             255875, 255878, 255879, 255880
    Reviewed by:    donner, kp
    Sponsored by:   The FreeBSD Foundation

    (cherry picked from commit c4a6258d70f73c27d8f0c6233edbcc609791806b)

 sys/netpfil/ipfw/dn_aqm_codel.c      | 4 +---
 sys/netpfil/ipfw/dn_aqm_pie.c        | 6 +++---
 sys/netpfil/ipfw/dn_sched_fq_codel.c | 4 +---
 sys/netpfil/ipfw/dn_sched_fq_pie.c   | 6 +++---
 4 files changed, 8 insertions(+), 12 deletions(-)