pf: Always initialise pf_fragment.fr_flags

When we allocate the struct pf_fragment in pf_fillup_fragment() we forgot to
initialise the fr_flags field. As a result we sometimes mistakenly thought the
fragment to not be a buffered fragment. This resulted in panics because we'd end
up freeing the pf_fragment but not removing it from V_pf_fragqueue (believing it
to be part of V_pf_cachequeue).
The next time we iterated V_pf_fragqueue we'd use a freed object and panic.

While here also fix a pf_fragment use after free in pf_normalize_ip().
pf_reassemble() frees the pf_fragment, so we can't use it any more.

PR:		201879, 201932
MFC after:	5 days

diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c
index 384f5653bdeca9c0579307dc781f60711ee1cbe6..497f0ed41fc781277cd55e64bcc7408b911edccb 100644 (file)
--- a/sys/netpfil/pf/pf_norm.c
+++ b/sys/netpfil/pf/pf_norm.c
@@ -431,6 +431,7 @@ pf_fillup_fragment(struct pf_fragment_cmp *key, struct pf_frent *frent,
                }
 
                *(struct pf_fragment_cmp *)frag = *key;
+               frag->fr_flags = 0;
                frag->fr_timeout = time_second;
                frag->fr_maxlen = frent->fe_len;
                TAILQ_INIT(&frag->fr_queue);
@@ -1284,9 +1285,6 @@ pf_normalize_ip(struct mbuf **m0, int dir, struct pfi_kif *kif, u_short *reason,
                if (m == NULL)
                        return (PF_DROP);
 
-               if (frag != NULL && (frag->fr_flags & PFFRAG_DROP))
-                       goto drop;
-
                h = mtod(m, struct ip *);
        } else {
                /* non-buffering fragment cache (drops or masks overlaps) */