svn commit: r352672 - stable/12/sys/netinet6

[Michael Tuexen]

Author: tuexen
Date: Wed Sep 25 10:38:44 2019
New Revision: 352672
URL: https://svnweb.freebsd.org/changeset/base/352672

Log:
  MFC r352511:
  
  When processing an incoming IPv6 packet over the loopback interface which
  contains Hop-by-Hop options, the mbuf chain is potentially changed in
  ip6_hopopts_input(), called by ip6_input_hbh().
  This can happen, because of the the use of IP6_EXTHDR_CHECK, which might
  call m_pullup().
  So provide the updated pointer back to the called of ip6_input_hbh() to
  avoid using a freed mbuf chain in`ip6_input()`.
  
  Reviewed by:		markj@
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D21664

Modified:
  stable/12/sys/netinet6/ip6_input.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet6/ip6_input.c
==============================================================================
--- stable/12/sys/netinet6/ip6_input.c	Wed Sep 25 07:51:30 2019	(r352671)
+++ stable/12/sys/netinet6/ip6_input.c	Wed Sep 25 10:38:44 2019	(r352672)
@@ -404,20 +404,22 @@ VNET_SYSUNINIT(inet6, SI_SUB_PROTO_DOMAIN, SI_ORDER_TH
 #endif
 
 static int
-ip6_input_hbh(struct mbuf *m, uint32_t *plen, uint32_t *rtalert, int *off,
+ip6_input_hbh(struct mbuf **mp, uint32_t *plen, uint32_t *rtalert, int *off,
     int *nxt, int *ours)
 {
+	struct mbuf *m;
 	struct ip6_hdr *ip6;
 	struct ip6_hbh *hbh;
 
-	if (ip6_hopopts_input(plen, rtalert, &m, off)) {
+	if (ip6_hopopts_input(plen, rtalert, mp, off)) {
 #if 0	/*touches NULL pointer*/
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
+		in6_ifstat_inc((*mp)->m_pkthdr.rcvif, ifs6_in_discard);
 #endif
 		goto out;	/* m have already been freed */
 	}
 
 	/* adjust pointer */
+	m = *mp;
 	ip6 = mtod(m, struct ip6_hdr *);
 
 	/*
@@ -857,7 +859,7 @@ passin:
 	 */
 	plen = (u_int32_t)ntohs(ip6->ip6_plen);
 	if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
-		if (ip6_input_hbh(m, &plen, &rtalert, &off, &nxt, &ours) != 0)
+		if (ip6_input_hbh(&m, &plen, &rtalert, &off, &nxt, &ours) != 0)
 			return;
 	} else
 		nxt = ip6->ip6_nxt;