svn commit: r347591 - in releng: 11.2/sys/netpfil/pf 12.0/sys/netpfil/pf

[Gordon Tetlow]

Author: gordon
Date: Tue May 14 23:10:21 2019
New Revision: 347591
URL: https://svnweb.freebsd.org/changeset/base/347591

Log:
  Fix IPv6 fragment reassembly panic in pf
  
  Approved by:	so
  Security:	FreeBSD-SA-19:05.pf
  Security:	CVE-2019-5597

Modified:
  releng/11.2/sys/netpfil/pf/pf_norm.c
  releng/12.0/sys/netpfil/pf/pf_norm.c

Modified: releng/11.2/sys/netpfil/pf/pf_norm.c
==============================================================================
--- releng/11.2/sys/netpfil/pf/pf_norm.c	Tue May 14 23:06:26 2019	(r347590)
+++ releng/11.2/sys/netpfil/pf/pf_norm.c	Tue May 14 23:10:21 2019	(r347591)
@@ -652,11 +652,11 @@ pf_reassemble6(struct mbuf **m0, struct ip6_hdr *ip6, 
 	}
 
 	/* We have all the data. */
+	frent = TAILQ_FIRST(&frag->fr_queue);
+	KASSERT(frent != NULL, ("frent != NULL"));
 	extoff = frent->fe_extoff;
 	maxlen = frag->fr_maxlen;
 	frag_id = frag->fr_id;
-	frent = TAILQ_FIRST(&frag->fr_queue);
-	KASSERT(frent != NULL, ("frent != NULL"));
 	total = TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_off +
 		TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_len;
 	hdrlen = frent->fe_hdrlen - sizeof(struct ip6_frag);

Modified: releng/12.0/sys/netpfil/pf/pf_norm.c
==============================================================================
--- releng/12.0/sys/netpfil/pf/pf_norm.c	Tue May 14 23:06:26 2019	(r347590)
+++ releng/12.0/sys/netpfil/pf/pf_norm.c	Tue May 14 23:10:21 2019	(r347591)
@@ -668,11 +668,11 @@ pf_reassemble6(struct mbuf **m0, struct ip6_hdr *ip6, 
 	}
 
 	/* We have all the data. */
+	frent = TAILQ_FIRST(&frag->fr_queue);
+	KASSERT(frent != NULL, ("frent != NULL"));
 	extoff = frent->fe_extoff;
 	maxlen = frag->fr_maxlen;
 	frag_id = frag->fr_id;
-	frent = TAILQ_FIRST(&frag->fr_queue);
-	KASSERT(frent != NULL, ("frent != NULL"));
 	total = TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_off +
 		TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_len;
 	hdrlen = frent->fe_hdrlen - sizeof(struct ip6_frag);