]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
When processing an incoming IPv6 packet over the loopback interface which
authortuexen <tuexen@FreeBSD.org>
Thu, 19 Sep 2019 10:22:29 +0000 (10:22 +0000)
committertuexen <tuexen@FreeBSD.org>
Thu, 19 Sep 2019 10:22:29 +0000 (10:22 +0000)
commit699a34f40f393557f0ad510b11cb72d6b818c35d
treed7f41055f7b483cd6de90014fdcc4cb71305b02d
parent99cb216bf9689a0141a8d47d9fe4b617a9360d5d
When processing an incoming IPv6 packet over the loopback interface which
contains Hop-by-Hop options, the mbuf chain is potentially changed in
ip6_hopopts_input(), called by ip6_input_hbh().
This can happen, because of the the use of IP6_EXTHDR_CHECK, which might
call m_pullup().
So provide the updated pointer back to the called of ip6_input_hbh() to
avoid using a freed mbuf chain in`ip6_input()`.

Reviewed by: markj@
MFC after: 3 days
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D21664
sys/netinet6/ip6_input.c