CVS commit: src/tests/net/if_wg

["Taylor R Campbell" <riastradh%netbsd.org@localhost>]

Module Name:    src
Committed By:   riastradh
Date:           Tue Oct  8 02:28:43 UTC 2024

Modified Files:
        src/tests/net/if_wg: t_basic.sh

Log Message:
wg(4): Test truncated UDP input from the network.

This triggers double-free in the IPv6 udp6_input path -- but,
confusingly, not the IPv4 udp_input path, even though the overudp_cb
interface ought to be the same:

/* udp_input -- no further use of m if return is -1 */
        if ((n = udp4_realinput(&src, &dst, &m, iphlen)) == -1) {
                UDP_STATINC(UDP_STAT_HDROPS);
                return;
        }

/* udp6_input -- m_freem if return is not 0 */
        if (udp6_realinput(AF_INET6, &src, &dst, &m, off) == 0) {
...
        }

bad:
        m_freem(m);
        return IPPROTO_DONE;

The subroutines udp4_realinput and udp6_realinput pass through the
return value of overudp_cb in essentially the same way:

/* udp4_realinput */
                if (inp->inp_overudp_cb != NULL) {
                        int ret;
                        ret = inp->inp_overudp_cb(mp, off, inp->inp_socket,
                            sintosa(src), inp->inp_overudp_arg);
                        switch (ret) {
                        case -1: /* Error, m was freed */
                                rcvcnt = -1;
                                goto bad;
...
bad:
        return rcvcnt;

/* udp6_realinput */
                if (inp->inp_overudp_cb != NULL) {
                        int ret;
                        ret = inp->inp_overudp_cb(mp, off, inp->inp_socket,
                            sin6tosa(src), inp->inp_overudp_arg);
                        switch (ret) {
                        case -1: /* Error, m was freed */
                                rcvcnt = -1;
                                goto bad;
...
bad:
        return rcvcnt;

PR kern/58688: userland panic of kernel via wg(4)


To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.5 src/tests/net/if_wg/t_basic.sh

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.