IPv6: Fix a panic in the nd6 code with unmapped mbufs.
If the neighbor entry for an IPv6 TCP session using unmapped mbufs times out, IPv6 will send an icmp6 dest. unreachable message. In doing this, it will try to do a software checksum on the reflected packet. If this is a TCP session using unmapped mbufs, then there will be a kernel panic. To fix this, just free packets with unmapped mbufs, rather than sending the icmp. Reviewed by: np, rrs Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D24821
This commit is contained in:
parent
cf55371827
commit
bc74b81991
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=360982
@ -821,10 +821,28 @@ nd6_llinfo_timer(void *arg)
|
||||
clear_llinfo_pqueue(ln);
|
||||
}
|
||||
nd6_free(&ln, 0);
|
||||
if (m != NULL)
|
||||
if (m != NULL) {
|
||||
struct mbuf *n = m;
|
||||
|
||||
/*
|
||||
* if there are any ummapped mbufs, we
|
||||
* must free them, rather than using
|
||||
* them for an ICMP, as they cannot be
|
||||
* checksummed.
|
||||
*/
|
||||
while ((n = n->m_next) != NULL) {
|
||||
if (n->m_flags & M_EXTPG)
|
||||
break;
|
||||
}
|
||||
if (n != NULL) {
|
||||
m_freem(m);
|
||||
m = NULL;
|
||||
} else {
|
||||
icmp6_error2(m, ICMP6_DST_UNREACH,
|
||||
ICMP6_DST_UNREACH_ADDR, 0, ifp);
|
||||
}
|
||||
}
|
||||
}
|
||||
break;
|
||||
case ND6_LLINFO_REACHABLE:
|
||||
if (!ND6_LLINFO_PERMANENT(ln))
|
||||
|
Loading…
Reference in New Issue
Block a user