git: bcad901cbfda - stable/14 - pf: ensure 'off' is always set before use

The branch stable/14 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=bcad901cbfda785298740cf6e0271b874d348503

commit bcad901cbfda785298740cf6e0271b874d348503
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2023-09-28 07:04:32 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2023-10-02 09:32:14 +0000

    pf: ensure 'off' is always set before use
    
    If we bail out early from pf_test(6)() we still need to clean up/finish
    SCTP multihome work, which requires the 'off' value to be set. Set it
    early enough.
    
    MFC after:      3 days
    Sponsored by:   Orange Business Services
    
    (cherry picked from commit aefda9c92da6571d405e1b27c5c68333ad8bbc57)
---
 sys/netpfil/pf/pf.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 6a8ba7be56cf..9e6cd7fae492 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -7698,6 +7698,9 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
 	pd.af = AF_INET;
 	pd.act.rtableid = -1;
 
+	h = mtod(m, struct ip *);
+	off = h->ip_hl << 2;
+
 	if (__predict_false(ip_divert_ptr != NULL) &&
 	    ((ipfwtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL)) != NULL)) {
 		struct ipfw_rule_ref *rr = (struct ipfw_rule_ref *)(ipfwtag+1);
@@ -8249,6 +8252,9 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb
 	pd.af = AF_INET6;
 	pd.act.rtableid = -1;
 
+	h = mtod(m, struct ip6_hdr *);
+	off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
+
 	/* We do IP header normalization and packet reassembly here */
 	if (pf_normalize_ip6(m0, kif, &reason, &pd) != PF_PASS) {
 		action = PF_DROP;
@@ -8256,6 +8262,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb
 	}
 	m = *m0;	/* pf_normalize messes with m0 */
 	h = mtod(m, struct ip6_hdr *);
+	off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
 
 	/*
 	 * we do not support jumbogram.  if we keep going, zero ip6_plen
@@ -8272,7 +8279,6 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb
 	pd.tos = IPV6_DSCP(h);
 	pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
 
-	off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
 	pd.proto = h->ip6_nxt;
 	do {
 		switch (pd.proto) {