svn commit: r352511 - head/sys/netinet6

Michael Tuexen tuexen at FreeBSD.org
Thu Sep 19 10:22:29 UTC 2019


Author: tuexen
Date: Thu Sep 19 10:22:29 2019
New Revision: 352511
URL: https://svnweb.freebsd.org/changeset/base/352511

Log:
  When processing an incoming IPv6 packet over the loopback interface which
  contains Hop-by-Hop options, the mbuf chain is potentially changed in
  ip6_hopopts_input(), called by ip6_input_hbh().
  This can happen, because of the the use of IP6_EXTHDR_CHECK, which might
  call m_pullup().
  So provide the updated pointer back to the called of ip6_input_hbh() to
  avoid using a freed mbuf chain in`ip6_input()`.
  
  Reviewed by:		markj@
  MFC after:		3 days
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D21664

Modified:
  head/sys/netinet6/ip6_input.c

Modified: head/sys/netinet6/ip6_input.c
==============================================================================
--- head/sys/netinet6/ip6_input.c	Thu Sep 19 10:06:18 2019	(r352510)
+++ head/sys/netinet6/ip6_input.c	Thu Sep 19 10:22:29 2019	(r352511)
@@ -403,20 +403,22 @@ VNET_SYSUNINIT(inet6, SI_SUB_PROTO_DOMAIN, SI_ORDER_TH
 #endif
 
 static int
-ip6_input_hbh(struct mbuf *m, uint32_t *plen, uint32_t *rtalert, int *off,
+ip6_input_hbh(struct mbuf **mp, uint32_t *plen, uint32_t *rtalert, int *off,
     int *nxt, int *ours)
 {
+	struct mbuf *m;
 	struct ip6_hdr *ip6;
 	struct ip6_hbh *hbh;
 
-	if (ip6_hopopts_input(plen, rtalert, &m, off)) {
+	if (ip6_hopopts_input(plen, rtalert, mp, off)) {
 #if 0	/*touches NULL pointer*/
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
+		in6_ifstat_inc((*mp)->m_pkthdr.rcvif, ifs6_in_discard);
 #endif
 		goto out;	/* m have already been freed */
 	}
 
 	/* adjust pointer */
+	m = *mp;
 	ip6 = mtod(m, struct ip6_hdr *);
 
 	/*
@@ -854,7 +856,7 @@ passin:
 	 */
 	plen = (u_int32_t)ntohs(ip6->ip6_plen);
 	if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
-		if (ip6_input_hbh(m, &plen, &rtalert, &off, &nxt, &ours) != 0)
+		if (ip6_input_hbh(&m, &plen, &rtalert, &off, &nxt, &ours) != 0)
 			return;
 	} else
 		nxt = ip6->ip6_nxt;


More information about the svn-src-all mailing list