Date: Mon, 17 Apr 2006 18:43:04 GMT From: James Juran <James.Juran@baesystems.com> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/95957: missing check for failed memory alloc in icmp6_input() Message-ID: <200604171843.k3HIh4Qq017542@www.freebsd.org> Resent-Message-ID: <200604171850.k3HIoCF5072395@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 95957
>Category: kern
>Synopsis: missing check for failed memory alloc in icmp6_input()
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Apr 17 18:50:11 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator: James Juran
>Release: 7.0-CURRENT
>Organization:
BAE Systems Inc.
>Environment:
N/A
>Description:
It appears that the processing of the ICMP6_WRUREQUEST message in icmp6_input
is missing a check for a failed memory allocation from MGETHDR(M_DONTWAIT).
The mbuf allocated by MGETHDR() is passed to m_dup_pkthdr() without first
verifying that it is non-NULL, and m_dup_pkthdr() references through its
first argument, also without verifying that it is non-NULL. So if this
allocation fails we will get a kernel panic in m_dup_pkthdr().
>How-To-Repeat:
code inspection
>Fix:
Change
if (!m_dup_pkthdr(n, m, M_DONTWAIT)) {
to
if (n && !m_dup_pkthdr(n, m, M_DONTWAIT)) {
at line 686 of icmp6.c.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200604171843.k3HIh4Qq017542>