git: 64c90f0dfe78 - stable/15 - igmp: Refresh the ip header pointer after m_pullup()

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=64c90f0dfe78366655b2f3cf642b99c4898cc6c5

commit 64c90f0dfe78366655b2f3cf642b99c4898cc6c5
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-09-29 19:16:57 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-22 15:45:40 +0000

    igmp: Refresh the ip header pointer after m_pullup()
    
    There is a chance that the m_pullup() call immediately above invalidated
    the "ip" pointer, so refresh it as we do with the IGMP header.
    Otherwise the test in igmp_input_v3_query() for whether the packet is an
    IGMPv3 general query might use a pointer to a freed mbuf.
    
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    
    (cherry picked from commit dc47a6940d60d393b3d36ba0fc5cb84d06fafaea)
---
 sys/netinet/igmp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/netinet/igmp.c b/sys/netinet/igmp.c
index 5549e559434f..1683f7031093 100644
--- a/sys/netinet/igmp.c
+++ b/sys/netinet/igmp.c
@@ -1606,6 +1606,7 @@ igmp_input(struct mbuf **mp, int *offp, int proto)
 				IGMPSTAT_INC(igps_rcv_tooshort);
 				return (IPPROTO_DONE);
 			}
+			ip = mtod(m, struct ip *);
 			igmpv3 = (struct igmpv3 *)(mtod(m, uint8_t *) + iphlen);
 			if (igmp_input_v3_query(ifp, ip, igmpv3) != 0) {
 				m_freem(m);