if_stf: KASAN fix

[kp]

Summary

In in_stf_input() we grabbed a pointer to the IPv4 header and later did
an m_pullup() before we look at the IPv6 header. However, m_pullup()
could rearrange the mbuf chain and potentially invalidate the pointer to
the IPv4 header.

Avoid this issue by copying the IP header rather than getting a pointer
to it.

While here also ensure we've done an m_pullup() for the IPv4 header.

Reported by: markj, Jenkins (KASAN job)
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

[markj]

sys/net/if_stf.c

755

This could be m_copydata(m, 0, sizeof(*ip), &ip).

Also the check below implies that we could have sc == NULL, so it's not safe to dereference ifp yet. Using m_copydata() would fix that problem too.

[markj]

sys/net/if_stf.c

755

... that assumes though that the packet is at least 20 bytes long. I'm not sure if there's something guaranteeing that.

[kp]

Remarks

[markj]

The stf tests pass for me with KASAN+this change. Thanks!