Module Name: src
Committed By: maxv
Date: Thu Feb 1 15:53:16 UTC 2018
Modified Files:
src/sys/netinet6: raw_ip6.c
Log Message:
Fix use-after-free, the first m_copyback_cow may have freed the mbuf, so
it is wrong to read ip6->ip6_nxt.
To generate a diff of this commit:
cvs rdiff -u -r1.160 -r1.161 src/sys/netinet6/raw_ip6.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/netinet6/raw_ip6.c
diff -u src/sys/netinet6/raw_ip6.c:1.160 src/sys/netinet6/raw_ip6.c:1.161
--- src/sys/netinet6/raw_ip6.c:1.160 Tue Jan 30 14:49:25 2018
+++ src/sys/netinet6/raw_ip6.c Thu Feb 1 15:53:16 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: raw_ip6.c,v 1.160 2018/01/30 14:49:25 maxv Exp $ */
+/* $NetBSD: raw_ip6.c,v 1.161 2018/02/01 15:53:16 maxv Exp $ */
/* $KAME: raw_ip6.c,v 1.82 2001/07/23 18:57:56 jinmei Exp $ */
/*
@@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.160 2018/01/30 14:49:25 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.161 2018/02/01 15:53:16 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_ipsec.h"
@@ -475,6 +475,7 @@ rip6_output(struct mbuf *m, struct socke
if (so->so_proto->pr_protocol == IPPROTO_ICMPV6 ||
in6p->in6p_cksum != -1) {
+ const uint8_t nxt = ip6->ip6_nxt;
int off;
u_int16_t sum;
@@ -496,7 +497,7 @@ rip6_output(struct mbuf *m, struct socke
error = ENOBUFS;
goto bad;
}
- sum = in6_cksum(m, ip6->ip6_nxt, sizeof(*ip6), plen);
+ sum = in6_cksum(m, nxt, sizeof(*ip6), plen);
m = m_copyback_cow(m, off, sizeof(sum), (void *)&sum,
M_DONTWAIT);
if (m == NULL) {
