svn commit: r353038 - releng/12.1/sys/netinet6

[Michael Tuexen]

Author: tuexen
Date: Thu Oct  3 11:20:56 2019
New Revision: 353038
URL: https://svnweb.freebsd.org/changeset/base/353038

Log:
  MFS r352672:
  
  When processing an incoming IPv6 packet over the loopback interface which
  contains Hop-by-Hop options, the mbuf chain is potentially changed in
  ip6_hopopts_input(), called by ip6_input_hbh().
  This can happen, because of the the use of IP6_EXTHDR_CHECK, which might
  call m_pullup().
  So provide the updated pointer back to the called of ip6_input_hbh() to
  avoid using a freed mbuf chain inip6_input().
  
  Approved by:		re (kib@)
  Reviewed by:		markj@
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D21664

Modified:
  releng/12.1/sys/netinet6/ip6_input.c
Directory Properties:
  releng/12.1/   (props changed)

Modified: releng/12.1/sys/netinet6/ip6_input.c
==============================================================================
--- releng/12.1/sys/netinet6/ip6_input.c	Thu Oct  3 11:08:45 2019	(r353037)
+++ releng/12.1/sys/netinet6/ip6_input.c	Thu Oct  3 11:20:56 2019	(r353038)
@@ -404,20 +404,22 @@ VNET_SYSUNINIT(inet6, SI_SUB_PROTO_DOMAIN, SI_ORDER_TH
 #endif
 
 static int
-ip6_input_hbh(struct mbuf *m, uint32_t *plen, uint32_t *rtalert, int *off,
+ip6_input_hbh(struct mbuf **mp, uint32_t *plen, uint32_t *rtalert, int *off,
     int *nxt, int *ours)
 {
+	struct mbuf *m;
 	struct ip6_hdr *ip6;
 	struct ip6_hbh *hbh;
 
-	if (ip6_hopopts_input(plen, rtalert, &m, off)) {
+	if (ip6_hopopts_input(plen, rtalert, mp, off)) {
 #if 0	/*touches NULL pointer*/
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
+		in6_ifstat_inc((*mp)->m_pkthdr.rcvif, ifs6_in_discard);
 #endif
 		goto out;	/* m have already been freed */
 	}
 
 	/* adjust pointer */
+	m = *mp;
 	ip6 = mtod(m, struct ip6_hdr *);
 
 	/*
@@ -857,7 +859,7 @@ passin:
 	 */
 	plen = (u_int32_t)ntohs(ip6->ip6_plen);
 	if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
-		if (ip6_input_hbh(m, &plen, &rtalert, &off, &nxt, &ours) != 0)
+		if (ip6_input_hbh(&m, &plen, &rtalert, &off, &nxt, &ours) != 0)
 			return;
 	} else
 		nxt = ip6->ip6_nxt;