system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-11-05 18:22:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix null deref in mld_v1_transmit_report

Browse source 
After r337866 it is possible for an in_multi6 to be referenced while
mid teardown. Handle case of cleared ifnet pointer.

Reported by:	ae
This commit is contained in:
Matt Macy 2018-08-21 23:03:02 +00:00
parent 77ad07b6a3
commit f3499ce48f
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=338163
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
sys/netinet6/mld6.c
View file

@ -1798,8 +1798,11 @@ mld_v1_transmit_report(struct in6_multi *in6m, const int type)
IN6_MULTI_LIST_LOCK_ASSERT();
MLD_LOCK_ASSERT();
ifp = in6m->in6m_ifp;
/* in process of being freed */
if (ifp == NULL)
return (0);
ia = in6ifa_ifpforlinklocal(ifp, IN6_IFF_NOTREADY|IN6_IFF_ANYCAST);
/* ia may be NULL if link-local address is tentative. */