kern/95957: missing check for failed memory alloc in icmp6_input()

[James Juran]

>Number:         95957
>Category:       kern
>Synopsis:       missing check for failed memory alloc in icmp6_input()
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Apr 17 18:50:11 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     James Juran
>Release:        7.0-CURRENT
>Organization:
BAE Systems Inc.
>Environment:
N/A
>Description:
It appears that the processing of the ICMP6_WRUREQUEST message in icmp6_input
is missing a check for a failed memory allocation from MGETHDR(M_DONTWAIT).
The mbuf allocated by MGETHDR() is passed to m_dup_pkthdr() without first
verifying that it is non-NULL, and m_dup_pkthdr() references through its
first argument, also without verifying that it is non-NULL.  So if this
allocation fails we will get a kernel panic in m_dup_pkthdr().


>How-To-Repeat:
code inspection
>Fix:
Change

			if (!m_dup_pkthdr(n, m, M_DONTWAIT)) {

to

			if (n && !m_dup_pkthdr(n, m, M_DONTWAIT)) {

at line 686 of icmp6.c.

>Release-Note:
>Audit-Trail:
>Unformatted: