{"push_id":1692762518,"size":1,"distinct_size":1,"ref":"refs/heads/stable/10","head":"f997910e54b19e3bf30bd9f0d17885b0a90b15c5","before":"bf6ac4a315def7a533558327b6942d7d83b8cba2","commits":[{"sha":"f997910e54b19e3bf30bd9f0d17885b0a90b15c5","author":{"name":"cy","email":"8e7af2df40968db17bcf20142c9fe3377726ad01@FreeBSD.org"},"message":"MFC r316809:\n\nFix a use after free panic in ipfilter's fragment processing.\nMemory is malloc'd, then a search for a match in the fragment table\nis made and if the fragment matches, the wrong fragment table is\nfreed, causing a use after free panic. This commit fixes this.\n\nA symptom of the problem is a kernel page fault in bcopy() called by\nipf_frag_lookup() at line 715 in ip_frag.c. Another symptom is a\nkernel page fault in ipf_frag_delete() when called by ipf_frag_expire()\nvia ipf_slowtimer().","distinct":true,"url":"https://api.github.com/repos/freebsd/freebsd/commits/f997910e54b19e3bf30bd9f0d17885b0a90b15c5"}]}
{"actor":{"display_login":"uqs"}}