Date: Thu, 14 Jun 2018 09:36:25 +0000 (UTC) From: "Andrey V. Elsukov" <ae@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r335129 - head/sys/netinet6 Message-ID: <201806140936.w5E9aP5e056650@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ae Date: Thu Jun 14 09:36:25 2018 New Revision: 335129 URL: https://svnweb.freebsd.org/changeset/base/335129 Log: Add NULL check like the rest of code has. It is possible that ifma_protospec becomes NULL in this function for some entry, but it is still referenced and thus it will not unlinked from the list. Then "restart" condition triggers and this entry with NULL ifma_protospec will lead to page fault. PR: 228982 Modified: head/sys/netinet6/mld6.c Modified: head/sys/netinet6/mld6.c ============================================================================== --- head/sys/netinet6/mld6.c Thu Jun 14 09:29:39 2018 (r335128) +++ head/sys/netinet6/mld6.c Thu Jun 14 09:36:25 2018 (r335129) @@ -1679,7 +1679,8 @@ mld_v2_cancel_link_timers(struct mld_ifsoftc *mli) IF_ADDR_WLOCK(ifp); restart: CK_STAILQ_FOREACH_SAFE(ifma, &ifp->if_multiaddrs, ifma_link, next) { - if (ifma->ifma_addr->sa_family != AF_INET6) + if (ifma->ifma_addr->sa_family != AF_INET6 || + ifma->ifma_protospec == NULL) continue; inm = (struct in6_multi *)ifma->ifma_protospec; switch (inm->in6m_state) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201806140936.w5E9aP5e056650>