svn commit: r338163 - head/sys/netinet6

[Matt Macy]

Author: mmacy
Date: Tue Aug 21 23:03:02 2018
New Revision: 338163
URL: https://svnweb.freebsd.org/changeset/base/338163

Log:
  Fix null deref in mld_v1_transmit_report
  
  After r337866 it is possible for an in_multi6 to be referenced while
  mid teardown. Handle case of cleared ifnet pointer.
  
  Reported by:	ae

Modified:
  head/sys/netinet6/mld6.c

Modified: head/sys/netinet6/mld6.c
==============================================================================
--- head/sys/netinet6/mld6.c	Tue Aug 21 22:59:22 2018	(r338162)
+++ head/sys/netinet6/mld6.c	Tue Aug 21 23:03:02 2018	(r338163)
@@ -1798,8 +1798,11 @@ mld_v1_transmit_report(struct in6_multi *in6m, const i
 
 	IN6_MULTI_LIST_LOCK_ASSERT();
 	MLD_LOCK_ASSERT();
-
+	
 	ifp = in6m->in6m_ifp;
+	/* in process of being freed */
+	if (ifp == NULL)
+		return (0);
 	ia = in6ifa_ifpforlinklocal(ifp, IN6_IFF_NOTREADY|IN6_IFF_ANYCAST);
 	/* ia may be NULL if link-local address is tentative. */