Page MenuHomeFreeBSD

Static analysis: Fix potential NULL dereference in ICMP6 code
ClosedPublic

Authored by jtl on May 26 2017, 4:54 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Sep 29, 3:58 AM
Unknown Object (File)
Aug 8 2025, 4:05 AM
Unknown Object (File)
Aug 3 2025, 6:19 PM
Unknown Object (File)
Jun 2 2025, 9:27 AM
Unknown Object (File)
May 15 2025, 5:02 AM
Unknown Object (File)
May 12 2025, 9:14 PM
Unknown Object (File)
May 9 2025, 7:22 PM
Unknown Object (File)
May 8 2025, 1:46 PM
Subscribers

Details

Summary

I ran clang's static analyzer over the kernel sources. It identified (apparently, correctly) two places in the ICMP6 code where we could dereference a NULL pointer in the icmp6_input() function.

When processing an ICMP6_ECHO_REQUEST, if IP6_EXTHDR_GET fails, it will set nicmp6 and n to NULL. Therefore, we should condition our modification to nicmp6 on n being not NULL.

And, when processing an ICMP6_WRUREQUEST in the (mode != FQDN) case, if m_dup_pkthdr() fails, the code will set n to NULL. However, the very next line dereferences n. Therefore, when m_dup_pkthdr() fails, we should discontinue further processing and follow the same path as when m_gethdr() fails.

Sponsored by: Netflix
MFC after: 2 weeks

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable