netinet6: set ip6 after m_pullup() in nd6_ra_input()

[vinicius_ferrao.net.br]

Summary

nd6_ra_input() reads the IPv6 header pointer ip6 before m_pullup(), then
uses that pointer afterwards to set nd_ra.

When m_pullup() relocates the chain it frees the original first mbuf and
returns a new one, leaving ip6 dangling; the subsequent access may be a
use-after-free read.

The fix writes ip6 from the returned mbuf after m_pullup() inside the
conditional if.

Test Plan

Kernel was rebuilt and basic connectivity test was made.

[pouria]

LGTM

[vinicius_ferrao.net.br]

In D58229#1335691, @pouria wrote:

LGTM

LOL.

That was extremely fast, I went to the kitchen to get a glass of water and it's approved.

I spent like 5 days testing it... haha.

Thanks @pouria