Author: mmacy
Date: Tue Aug 21 23:03:02 2018
New Revision: 338163
URL: https://svnweb.freebsd.org/changeset/base/338163
Log:
Fix null deref in mld_v1_transmit_report
After r337866 it is possible for an in_multi6 to be referenced while
mid teardown. Handle case of cleared ifnet pointer.
Reported by: ae
Modified:
head/sys/netinet6/mld6.c
Modified: head/sys/netinet6/mld6.c
==============================================================================
--- head/sys/netinet6/mld6.c Tue Aug 21 22:59:22 2018 (r338162)
+++ head/sys/netinet6/mld6.c Tue Aug 21 23:03:02 2018 (r338163)
@@ -1798,8 +1798,11 @@ mld_v1_transmit_report(struct in6_multi *in6m, const i
IN6_MULTI_LIST_LOCK_ASSERT();
MLD_LOCK_ASSERT();
-
+
ifp = in6m->in6m_ifp;
+ /* in process of being freed */
+ if (ifp == NULL)
+ return (0);
ia = in6ifa_ifpforlinklocal(ifp, IN6_IFF_NOTREADY|IN6_IFF_ANYCAST);
/* ia may be NULL if link-local address is tentative. */
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
