PR/58688 CVS commit: src/tests/net/if_wg

["Taylor R Campbell" <riastradh%netbsd.org@localhost>]

The following reply was made to PR kern/58688; it has been noted by GNATS.

From: "Taylor R Campbell" <riastradh%netbsd.org@localhost>
To: gnats-bugs%gnats.NetBSD.org@localhost
Cc: 
Subject: PR/58688 CVS commit: src/tests/net/if_wg
Date: Tue, 8 Oct 2024 02:28:43 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Tue Oct  8 02:28:43 UTC 2024
 
 Modified Files:
 	src/tests/net/if_wg: t_basic.sh
 
 Log Message:
 wg(4): Test truncated UDP input from the network.
 
 This triggers double-free in the IPv6 udp6_input path -- but,
 confusingly, not the IPv4 udp_input path, even though the overudp_cb
 interface ought to be the same:
 
 /* udp_input -- no further use of m if return is -1 */
 	if ((n = udp4_realinput(&src, &dst, &m, iphlen)) == -1) {
 		UDP_STATINC(UDP_STAT_HDROPS);
 		return;
 	}
 
 /* udp6_input -- m_freem if return is not 0 */
 	if (udp6_realinput(AF_INET6, &src, &dst, &m, off) == 0) {
 ...
 	}
 
 bad:
 	m_freem(m);
 	return IPPROTO_DONE;
 
 The subroutines udp4_realinput and udp6_realinput pass through the
 return value of overudp_cb in essentially the same way:
 
 /* udp4_realinput */
 		if (inp->inp_overudp_cb != NULL) {
 			int ret;
 			ret = inp->inp_overudp_cb(mp, off, inp->inp_socket,
 			    sintosa(src), inp->inp_overudp_arg);
 			switch (ret) {
 			case -1: /* Error, m was freed */
 				rcvcnt = -1;
 				goto bad;
 ...
 bad:
 	return rcvcnt;
 
 /* udp6_realinput */
 		if (inp->inp_overudp_cb != NULL) {
 			int ret;
 			ret = inp->inp_overudp_cb(mp, off, inp->inp_socket,
 			    sin6tosa(src), inp->inp_overudp_arg);
 			switch (ret) {
 			case -1: /* Error, m was freed */
 				rcvcnt = -1;
 				goto bad;
 ...
 bad:
 	return rcvcnt;
 
 PR kern/58688: userland panic of kernel via wg(4)
 
 
 To generate a diff of this commit:
 cvs rdiff -u -r1.4 -r1.5 src/tests/net/if_wg/t_basic.sh
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.