svn commit: r358427 - head/sys/netinet6

[Bjoern A. Zeeb]

Author: bz
Date: Fri Feb 28 11:16:41 2020
New Revision: 358427
URL: https://svnweb.freebsd.org/changeset/base/358427

Log:
  mld6: initialize oifp to avoid bogus results/panics in edge cases
  
  In certain cases (probably not during normal operation but observed in
  the lab during development) ip6_ouput() could return without error
  and ifpp (&oifp) not updated.
  Given oifp was never initialized we would take the later branch
  as oifp was not NULL, and when calling icmp6_ifstat_inc() we would
  panic dereferencing a garbage pointer.
  For code stability initialize oifp to NULL before first use to always
  have a deterministic value and not rely on a called function to behave
  and always and for ever do the work for us as we hope for.
  
  MFC after:	3 days
  Sponsored by:	Netflix

Modified:
  head/sys/netinet6/mld6.c

Modified: head/sys/netinet6/mld6.c
==============================================================================
--- head/sys/netinet6/mld6.c	Fri Feb 28 10:57:23 2020	(r358426)
+++ head/sys/netinet6/mld6.c	Fri Feb 28 11:16:41 2020	(r358427)
@@ -3159,6 +3159,7 @@ mld_dispatch_packet(struct mbuf *m)
 	mld = (struct mld_hdr *)(mtod(md, uint8_t *) + off);
 	type = mld->mld_type;
 
+	oifp = NULL;
 	error = ip6_output(m0, &mld_po, NULL, IPV6_UNSPECSRC, &im6o,
 	    &oifp, NULL);
 	if (error) {