kern/60484: ipfilter: null pointer deref in icmp6 parsing

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60484
>Category:       kern
>Synopsis:       ipfilter: null pointer deref in icmp6 parsing
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 23 16:50:01 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The NetBSD Filtration, Ipf.
>Environment:
>Description:

	If ipfilter keeps state, feeding it a ICMP6 error packet with
	an encapsulated ICMP6 error packet may lead to a null pointer
	dereference, crashing the kernel.

   4364 ipf_checkicmp6matchingstate(fr_info_t *fin)
   4365 {
...
   4394 	oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN);
...
   4404 	ofin.fin_m = NULL;	/* if dereferenced, panic XXX */
   4405 	ofin.fin_mp = NULL;	/* if dereferenced, panic XXX */
...
   4420 	ofin.fin_ip = (ip_t *)oip6;
...
   4421 	(void) ipf_makefrip(sizeof(*oip6), (ip_t *)oip6, &ofin);

https://nxr.netbsd.org/xref/src/sys/external/bsd/ipf/netinet/ip_state.c?r=1.12#4353

   2033 ipf_makefrip(int hlen, ip_t *ip, fr_info_t *fin)
   2034 {
...
   2052 	} else if (v == 6) {
   2053 		fin->fin_plen = ntohs(((ip6_t *)ip)->ip6_plen);
   2054 		fin->fin_dlen = fin->fin_plen;
   2055 		fin->fin_plen += hlen;
   2056 
   2057 		ipf_pr_ipv6hdr(fin);

https://nxr.netbsd.org/xref/src/sys/external/bsd/ipf/netinet/fil.c?r=1.37#2020

    472 ipf_pr_ipv6hdr(fr_info_t *fin)
    473 {
...
    516 		case IPPROTO_ICMPV6 :
    517 			ipf_pr_icmp6(fin);

https://nxr.netbsd.org/xref/src/sys/external/bsd/ipf/netinet/fil.c?r=1.37#460

    905 ipf_pr_icmp6(fr_info_t *fin)
    906 {
...
    917 	if (fin->fin_dlen > 1) {
...
    927 		switch (icmp6->icmp6_type)
    928 		{
...
    936 		case ICMP6_DST_UNREACH :
    937 		case ICMP6_PACKET_TOO_BIG :
    938 		case ICMP6_TIME_EXCEEDED :
    939 		case ICMP6_PARAM_PROB :
...
 => 945 			if (M_LEN(fin->fin_m) < fin->fin_plen) {
    946 				if (ipf_coalesce(fin) != 1)
    947 					return;
    948 			}

https://nxr.netbsd.org/xref/src/sys/external/bsd/ipf/netinet/fil.c?r=1.37#895

	Forwarded to us by Chris Jarrett-Davies <chrisjd%openai.com@localhost>.

>How-To-Repeat:

	1. configure state and exchange packets creating state entries
	2. send an ICMP6 error with an encapsulated ICMP6 error

>Fix:

	Check fin->fin_m == NULL first.