Author: bz
Date: Fri Feb 28 11:16:41 2020
New Revision: 358427
URL: https://svnweb.freebsd.org/changeset/base/358427
Log:
mld6: initialize oifp to avoid bogus results/panics in edge cases
In certain cases (probably not during normal operation but observed in
the lab during development) ip6_ouput() could return without error
and ifpp (&oifp) not updated.
Given oifp was never initialized we would take the later branch
as oifp was not NULL, and when calling icmp6_ifstat_inc() we would
panic dereferencing a garbage pointer.
For code stability initialize oifp to NULL before first use to always
have a deterministic value and not rely on a called function to behave
and always and for ever do the work for us as we hope for.
MFC after: 3 days
Sponsored by: Netflix
Modified:
head/sys/netinet6/mld6.c
Modified: head/sys/netinet6/mld6.c
==============================================================================
--- head/sys/netinet6/mld6.c Fri Feb 28 10:57:23 2020 (r358426)
+++ head/sys/netinet6/mld6.c Fri Feb 28 11:16:41 2020 (r358427)
@@ -3159,6 +3159,7 @@ mld_dispatch_packet(struct mbuf *m)
mld = (struct mld_hdr *)(mtod(md, uint8_t *) + off);
type = mld->mld_type;
+ oifp = NULL;
error = ip6_output(m0, &mld_po, NULL, IPV6_UNSPECSRC, &im6o,
&oifp, NULL);
if (error) {
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
