git: a9c3d5de9ac8 - releng/12.4 - if_vxlan(4): Check the size of data available in mbuf before using them

From: Kristof Provost <kp_at_FreeBSD.org>
Date: Fri, 04 Nov 2022 12:22:33 UTC
The branch releng/12.4 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=a9c3d5de9ac8ae8090881f20c894d3577d97e92a

commit a9c3d5de9ac8ae8090881f20c894d3577d97e92a
Author:     Zhenlei Huang <zlei.huang@gmail.com>
AuthorDate: 2022-09-30 07:55:29 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2022-11-04 12:21:45 +0000

    if_vxlan(4): Check the size of data available in mbuf before using them
    
    PR:             261711
    Reviewed by:    kp
    Tested by:      Alfa (burak.sn at outlook.com)
    Approved by:    re (gjb), kp (mentor)
    Differential Revision:  https://reviews.freebsd.org/D36794
    
    (cherry picked from commit 8707cb19e68128c181477d87f960182c14e15f12)
    (cherry picked from commit 639aebb2aa0b72c569f8779e13351d37f7bb17c6)
---
 sys/net/if_vxlan.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sys/net/if_vxlan.c b/sys/net/if_vxlan.c
index 17f96727ca12..67aa760f7fcf 100644
--- a/sys/net/if_vxlan.c
+++ b/sys/net/if_vxlan.c
@@ -2560,6 +2560,12 @@ vxlan_input(struct vxlan_socket *vso, uint32_t vni, struct mbuf **m0,
 
 	ifp = sc->vxl_ifp;
 	m = *m0;
+	if (m->m_len < ETHER_HDR_LEN &&
+	    (m = m_pullup(m, ETHER_HDR_LEN)) == NULL) {
+		*m0 = NULL;
+		error = ENOBUFS;
+		goto out;
+	}
 	eh = mtod(m, struct ether_header *);
 
 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {