freebsd-src/sys/netpfil
Kristof Provost 0ba9cb5e71 dummynet: fix wf2q use-after-free
When we clean up a wf2q+ queue we need to ensure that we remove it from
the correct heap. If we leave a queue pointer behind in an unexpected
heap we'll later write to it, causing a use-after-free and unpredictable
panics.

Teach the dummynet heap code to verify that we're removing the correct
object so we can safely attempt to remove objects not contained in the
heap.

Remove a to-be-removed queue from all heaps.

Also don't continue the enqueue function if we're not finding the queue
on the idle heap as we'd expect.

While here also remove the empty heap warning, because this is now
expected to happen.

See also:	https://redmine.pfsense.org/issues/14433
Sponsored by:	Rubicon Communications, LLC ("Netgate")
2023-06-13 15:51:47 +02:00
..
ipfilter/netinet pfil: add pfil_mem_{in,out}() and retire pfil_run_hooks() 2023-02-14 10:02:49 -08:00
ipfw dummynet: fix wf2q use-after-free 2023-06-13 15:51:47 +02:00
pf pf: fix log message 2023-06-02 16:05:30 +02:00