In icmp6_rip6_input(), once we have a lock, make sure the inp is
not freed. This can happen since the list traversal and locking was converted to epoch(9). If the inp is marked "freed", skip it. This prevents a NULL pointer deref panic in ip6_savecontrol_v4() trying to access the socket hanging off the inp, which was gone by the time we got there. Reported by: andrew Tested by: andrew Approved by: re (gjb)
This commit is contained in:
parent
25ed23cfbb
commit
6675bee81a
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=338831
@ -1936,6 +1936,10 @@ icmp6_rip6_input(struct mbuf **mp, int off)
|
||||
!IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src))
|
||||
continue;
|
||||
INP_RLOCK(in6p);
|
||||
if (__predict_false(in6p->inp_flags2 & INP_FREED)) {
|
||||
INP_RUNLOCK(in6p);
|
||||
continue;
|
||||
}
|
||||
if (ICMP6_FILTER_WILLBLOCK(icmp6->icmp6_type,
|
||||
in6p->in6p_icmp6filt)) {
|
||||
INP_RUNLOCK(in6p);
|
||||
|
Loading…
Reference in New Issue
Block a user