diff options
| author | ae <ae@FreeBSD.org> | 2015-03-19 12:49:55 +0000 |
|---|---|---|
| committer | ae <ae@FreeBSD.org> | 2015-03-19 12:49:55 +0000 |
| commit | 7fe0fee3eb948182a252b31ed8c3acf4e9d6d74b (patch) | |
| tree | addee84fcb6f31bcc16619c6edabb1003e79f682 | |
| parent | bcbbcda0f2e4af8b9dd5b88b8aee78fb712e107e (diff) | |
| download | FreeBSD-src-7fe0fee3eb948182a252b31ed8c3acf4e9d6d74b.zip FreeBSD-src-7fe0fee3eb948182a252b31ed8c3acf4e9d6d74b.tar.gz | |
MFC r279910:
Reset mbuf pointer to NULL in fastroute case to indicate that mbuf was
consumed by filter. This fixes several panics due to accessing to mbuf
after free.
| -rw-r--r-- | sys/netpfil/pf/pf.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index d3e6598..302771d 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -5440,6 +5440,7 @@ pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, PF_STATE_UNLOCK(s); m0->m_flags |= M_SKIP_FIREWALL; ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL); + *m = NULL; return; } |
