d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

IPv6: Fix a panic in the nd6 code with unmapped mbufs.

Browse Source 
If the neighbor entry for an IPv6 TCP session using unmapped
mbufs times out, IPv6 will send an icmp6 dest. unreachable
message. In doing this, it will try to do a software checksum
on the reflected packet. If this is a TCP session using unmapped
mbufs, then there will be a kernel panic.

To fix this, just free packets with unmapped mbufs, rather
than sending the icmp.

Reviewed by:	np, rrs
Sponsored by:	Netflix
Differential Revision:	https://reviews.freebsd.org/D24821
This commit is contained in:
Andrew Gallatin 2020-05-12 17:18:44 +00:00
parent cf55371827
commit bc74b81991
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=360982
1 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
sys/netinet6/nd6.c
View File

@ -821,9 +821,27 @@ nd6_llinfo_timer(void *arg)
clear_llinfo_pqueue(ln);
}
nd6_free(&ln, 0);
if (m != NULL)
icmp6_error2(m, ICMP6_DST_UNREACH,
ICMP6_DST_UNREACH_ADDR, 0, ifp);
if (m != NULL) {
struct mbuf *n = m;
/*
* if there are any ummapped mbufs, we
* must free them, rather than using
* them for an ICMP, as they cannot be
* checksummed.
*/
while ((n = n->m_next) != NULL) {
if (n->m_flags & M_EXTPG)
break;
}
if (n != NULL) {
m_freem(m);
m = NULL;
} else {
icmp6_error2(m, ICMP6_DST_UNREACH,
ICMP6_DST_UNREACH_ADDR, 0, ifp);
}
}
}
break;
case ND6_LLINFO_REACHABLE: