Module Name: src
Committed By: maxv
Date: Fri Dec 13 14:13:55 UTC 2019
Modified Files:
src/sys/net: if_tun.c
Log Message:
Read the len before pushing the packet, otherwise possible use-after-free.
Found by a custom query on LGTM.
To generate a diff of this commit:
cvs rdiff -u -r1.156 -r1.157 src/sys/net/if_tun.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/if_tun.c
diff -u src/sys/net/if_tun.c:1.156 src/sys/net/if_tun.c:1.157
--- src/sys/net/if_tun.c:1.156 Fri Apr 26 08:38:25 2019
+++ src/sys/net/if_tun.c Fri Dec 13 14:13:55 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: if_tun.c,v 1.156 2019/04/26 08:38:25 pgoyette Exp $ */
+/* $NetBSD: if_tun.c,v 1.157 2019/12/13 14:13:55 maxv Exp $ */
/*
* Copyright (c) 1988, Julian Onions <[email protected]>
@@ -19,7 +19,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_tun.c,v 1.156 2019/04/26 08:38:25 pgoyette Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_tun.c,v 1.157 2019/12/13 14:13:55 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -609,6 +609,7 @@ tun_output(struct ifnet *ifp, struct mbu
}
/* FALLTHROUGH */
case AF_UNSPEC:
+ mlen = m0->m_pkthdr.len;
IFQ_ENQUEUE(&ifp->if_snd, m0, error);
if (error) {
ifp->if_collisions++;
@@ -616,7 +617,6 @@ tun_output(struct ifnet *ifp, struct mbu
m0 = NULL;
goto out;
}
- mlen = m0->m_pkthdr.len;
ifp->if_opackets++;
ifp->if_obytes += mlen;
break;
