svn commit: r358543 - stable/11/sys/netinet6

[Bjoern A. Zeeb]

Author: bz
Date: Mon Mar  2 13:23:51 2020
New Revision: 358543
URL: https://svnweb.freebsd.org/changeset/base/358543

Log:
  MFC r358427:  initialize oifp to avoid bogus results/panics in edge cases
  
    In certain cases (probably not during normal operation but observed in
    the lab during development) ip6_ouput() could return without error
    and ifpp (&oifp) not updated.
    Given oifp was never initialized we would take the later branch
    as oifp was not NULL, and when calling icmp6_ifstat_inc() we would
    panic dereferencing a garbage pointer.
    For code stability initialize oifp to NULL before first use to always
    have a deterministic value and not rely on a called function to behave
    and always and for ever do the work for us as we hope for.
  
    Sponsored by: Netflix

Modified:
  stable/11/sys/netinet6/mld6.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netinet6/mld6.c
==============================================================================
--- stable/11/sys/netinet6/mld6.c	Mon Mar  2 13:23:28 2020	(r358542)
+++ stable/11/sys/netinet6/mld6.c	Mon Mar  2 13:23:51 2020	(r358543)
@@ -3124,6 +3124,7 @@ mld_dispatch_packet(struct mbuf *m)
 	mld = (struct mld_hdr *)(mtod(md, uint8_t *) + off);
 	type = mld->mld_type;
 
+	oifp = NULL;
 	error = ip6_output(m0, &mld_po, NULL, IPV6_UNSPECSRC, &im6o,
 	    &oifp, NULL);
 	if (error) {