d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Clear 'ia' after iterating if_addrhead for unicast address matching: since

Browse Source 
'ifa' was used as the TAILQ_FOREACH() iterator argument, and 'ia' was just
derived form it, it could be left non-NULL which confused later
conditional freeing code.  This could cause kernel panics if multicast IP
packets were received.  [1]

Call 'struct in_ifaddr *' in ip_rtaddr() 'ia', not 'ifa' in keeping with
normal conventions.

When 'ipstealth' is enabled returns from ip_input early, properly release
the 'ia' reference.

Reported by:	lstewart, sam [1]
MFC after:	6 weeks
This commit is contained in:
Robert Watson 2009-06-24 14:29:40 +00:00
parent 3c366f1f14
commit 19e5b0a797
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=194835
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
sys/netinet/ip_input.c
View File

@ -661,6 +661,7 @@ ip_input(struct mbuf *m)
#endif
}
IF_ADDR_UNLOCK(ifp);
ia = NULL;
}
/* RFC 3927 2.7: Do not forward datagrams for 169.254.0.0/16. */
if (IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr))) {
@ -738,9 +739,11 @@ ip_input(struct mbuf *m)
* IPSTEALTH: Process non-routing options only
* if the packet is destined for us.
*/
if (V_ipstealth && hlen > sizeof (struct ip) &&
ip_dooptions(m, 1))
if (V_ipstealth && hlen > sizeof (struct ip) && ip_dooptions(m, 1)) {
if (ia != NULL)
ifa_free(&ia->ia_ifa);
return;
}
#endif /* IPSTEALTH */
/* Count the packet in the ip address stats */
@ -1349,7 +1352,7 @@ ip_rtaddr(struct in_addr dst, u_int fibnum)
{
struct route sro;
struct sockaddr_in *sin;
struct in_ifaddr *ifa;
struct in_ifaddr *ia;
bzero(&sro, sizeof(sro));
sin = (struct sockaddr_in *)&sro.ro_dst;
@ -1361,10 +1364,10 @@ ip_rtaddr(struct in_addr dst, u_int fibnum)
if (sro.ro_rt == NULL)
return (NULL);
ifa = ifatoia(sro.ro_rt->rt_ifa);
ifa_ref(&ifa->ia_ifa);
ia = ifatoia(sro.ro_rt->rt_ifa);
ifa_ref(&ia->ia_ifa);
RTFREE(sro.ro_rt);
return (ifa);
return (ia);
}
u_char inetctlerrmap[PRC_NCMDS] = {