HomeFreeBSD

nd6: fix panic in lltable_drop_entry_queue()

Description

nd6: fix panic in lltable_drop_entry_queue()

nd6_resolve_slow() can be called without mbuf. If the LLE entry
is not reachable, nd6_resolve_slow() will add this NULL mbuf to
the holdchain via lltable_append_entry_queue, which will "append"
NULL to the end of the queue (effectively no-op) and bump la_numhold
value. When this entry gets freed, the kernel will panic due to the
inconsistency between the amount of mbufs in the queue and the value
of la_numhold.

Fix the panic by checking of mbuf is not NULL prior to inserting it
into the holdchain.

Reported by: kib
MFC after: 3 days

(cherry picked from commit 6468b6b23e08d9bd02c8cb74ec0ff389ed74c3bb)

Details

Provenance
melifaroAuthored on Jan 15 2023, 3:10 PM
Parents
rGa38e2ff92458: netinet6: Fix mbuf leak in NDP
Branches
Unknown
Tags
Unknown