Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 7 May 2020 01:28:59 +0000 (UTC)
From:      Michael Tuexen <tuexen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r360733 - stable/11/sys/netinet6
Message-ID:  <202005070128.0471Sxmv055158@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: tuexen
Date: Thu May  7 01:28:59 2020
New Revision: 360733
URL: https://svnweb.freebsd.org/changeset/base/360733

Log:
  MFC r352511: Improve IPv6 handling over the loopback interface
  
  When processing an incoming IPv6 packet over the loopback interface which
  contains Hop-by-Hop options, the mbuf chain is potentially changed in
  ip6_hopopts_input(), called by ip6_input_hbh().
  This can happen, because of the the use of IP6_EXTHDR_CHECK, which might
  call m_pullup().
  So provide the updated pointer back to the called of ip6_input_hbh() to
  avoid using a freed mbuf chain in`ip6_input()`.
  
  Reviewed by:		markj
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D21664

Modified:
  stable/11/sys/netinet6/ip6_input.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netinet6/ip6_input.c
==============================================================================
--- stable/11/sys/netinet6/ip6_input.c	Thu May  7 01:16:32 2020	(r360732)
+++ stable/11/sys/netinet6/ip6_input.c	Thu May  7 01:28:59 2020	(r360733)
@@ -402,20 +402,22 @@ VNET_SYSUNINIT(inet6, SI_SUB_PROTO_DOMAIN, SI_ORDER_TH
 #endif
 
 static int
-ip6_input_hbh(struct mbuf *m, uint32_t *plen, uint32_t *rtalert, int *off,
+ip6_input_hbh(struct mbuf **mp, uint32_t *plen, uint32_t *rtalert, int *off,
     int *nxt, int *ours)
 {
+	struct mbuf *m;
 	struct ip6_hdr *ip6;
 	struct ip6_hbh *hbh;
 
-	if (ip6_hopopts_input(plen, rtalert, &m, off)) {
+	if (ip6_hopopts_input(plen, rtalert, mp, off)) {
 #if 0	/*touches NULL pointer*/
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
+		in6_ifstat_inc((*mp)->m_pkthdr.rcvif, ifs6_in_discard);
 #endif
 		goto out;	/* m have already been freed */
 	}
 
 	/* adjust pointer */
+	m = *mp;
 	ip6 = mtod(m, struct ip6_hdr *);
 
 	/*
@@ -855,7 +857,7 @@ passin:
 	 */
 	plen = (u_int32_t)ntohs(ip6->ip6_plen);
 	if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
-		if (ip6_input_hbh(m, &plen, &rtalert, &off, &nxt, &ours) != 0)
+		if (ip6_input_hbh(&m, &plen, &rtalert, &off, &nxt, &ours) != 0)
 			return;
 	} else
 		nxt = ip6->ip6_nxt;



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202005070128.0471Sxmv055158>