Date: Tue, 14 May 2019 23:10:22 +0000 (UTC) From: Gordon Tetlow <gordon@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r347591 - in releng: 11.2/sys/netpfil/pf 12.0/sys/netpfil/pf Message-ID: <201905142310.x4ENAMtQ053736@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: gordon Date: Tue May 14 23:10:21 2019 New Revision: 347591 URL: https://svnweb.freebsd.org/changeset/base/347591 Log: Fix IPv6 fragment reassembly panic in pf Approved by: so Security: FreeBSD-SA-19:05.pf Security: CVE-2019-5597 Modified: releng/11.2/sys/netpfil/pf/pf_norm.c releng/12.0/sys/netpfil/pf/pf_norm.c Modified: releng/11.2/sys/netpfil/pf/pf_norm.c ============================================================================== --- releng/11.2/sys/netpfil/pf/pf_norm.c Tue May 14 23:06:26 2019 (r347590) +++ releng/11.2/sys/netpfil/pf/pf_norm.c Tue May 14 23:10:21 2019 (r347591) @@ -652,11 +652,11 @@ pf_reassemble6(struct mbuf **m0, struct ip6_hdr *ip6, } /* We have all the data. */ + frent = TAILQ_FIRST(&frag->fr_queue); + KASSERT(frent != NULL, ("frent != NULL")); extoff = frent->fe_extoff; maxlen = frag->fr_maxlen; frag_id = frag->fr_id; - frent = TAILQ_FIRST(&frag->fr_queue); - KASSERT(frent != NULL, ("frent != NULL")); total = TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_off + TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_len; hdrlen = frent->fe_hdrlen - sizeof(struct ip6_frag); Modified: releng/12.0/sys/netpfil/pf/pf_norm.c ============================================================================== --- releng/12.0/sys/netpfil/pf/pf_norm.c Tue May 14 23:06:26 2019 (r347590) +++ releng/12.0/sys/netpfil/pf/pf_norm.c Tue May 14 23:10:21 2019 (r347591) @@ -668,11 +668,11 @@ pf_reassemble6(struct mbuf **m0, struct ip6_hdr *ip6, } /* We have all the data. */ + frent = TAILQ_FIRST(&frag->fr_queue); + KASSERT(frent != NULL, ("frent != NULL")); extoff = frent->fe_extoff; maxlen = frag->fr_maxlen; frag_id = frag->fr_id; - frent = TAILQ_FIRST(&frag->fr_queue); - KASSERT(frent != NULL, ("frent != NULL")); total = TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_off + TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_len; hdrlen = frent->fe_hdrlen - sizeof(struct ip6_frag);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201905142310.x4ENAMtQ053736>