⬢ DragonFlyBSD Kernel Audit
DF-3334 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
--- a/sys/net/netmap/netmap.c
+++ b/sys/net/netmap/netmap.c
@@ -1329,8 +1329,11 @@
 			}
 
 			error = netmap_mem_get_info(nmd, &nmr->nr_memsize, &memflags);
-			if (error)
+			if (error) {
+				if (na != NULL)	/* DF-3334: drop the get_na reference */
+					netmap_adapter_put(na);
 				break;
+			}
 			if (na == NULL) /* only memory info */
 				break;
 			nmr->nr_offset = 0;
@@ -1397,7 +1400,12 @@
 			nmr->nr_tx_slots = na->num_tx_desc;
 			error = netmap_mem_get_info(na->nm_mem, &nmr->nr_memsize, &memflags);
 			if (error) {
-				netmap_adapter_put(na);
+				/* DF-3334: the na reference now belongs to
+				 * priv->np_na (stored by netmap_do_regif);
+				 * dropping it here underflows the refcount
+				 * (premature free / UAF at dtor).  Report
+				 * the error; the registration stays valid
+				 * and is cleaned up by netmap_dtor. */
 				break;
 			}
 			if (memflags & NETMAP_MEM_PRIVATE) {