Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In icmp6_redirect_output(), sip6 is initialised to point to the data area of 

m0. But m0 may be freed later, so trying to use sip6 at the end of this
function is wrong. My guess is that we want to reference the data area
of m (the mbuf about to be send) instead at this point.
Fix a panic on Xen (where a data area of a mbuf may be unmapped when the
mbuf is freed), and probably potential data/pool corruption in other cases.
This commit is contained in:
bouyer 2005-10-19 20:42:54 +00:00
parent 35b726a534
commit b3b0d23068
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/netinet6/icmp6.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: icmp6.c,v 1.110 2005/08/18 00:30:59 yamt Exp $ */
/* $NetBSD: icmp6.c,v 1.111 2005/10/19 20:42:54 bouyer Exp $ */
/* $KAME: icmp6.c,v 1.217 2001/06/20 15:03:29 jinmei Exp $ */
/*
@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.110 2005/08/18 00:30:59 yamt Exp $");
__KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.111 2005/10/19 20:42:54 bouyer Exp $");
#include "opt_inet.h"
#include "opt_ipsec.h"
@ -2617,6 +2617,7 @@ noredhdropt:
m0 = NULL;
}
sip6 = mtod(m, struct ip6_hdr *);
if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_src))
sip6->ip6_src.s6_addr16[1] = 0;
if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_dst))