[src/netbsd-8]: src/sys/net Pull up following revision(s) (requested by ozaki...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2220a71ff4f3
branches:  netbsd-8
changeset: 455135:2220a71ff4f3
user:      martin <martin%NetBSD.org@localhost>
date:      Tue Oct 08 18:09:41 2019 +0000

description:
Pull up following revision(s) (requested by ozaki-r in ticket #1401):

        sys/net/if_ethersubr.c: revision 1.255

Fix two bugs in altq_etherclassify. When scanning the mbuf chain we need
to make sure that m_next is not NULL, otherwise NULL deref. After that,
we must not touch m->m_pkthdr, given that 'm' may not be the first mbuf
of the chain anymore.

Declare mtop, and add a KASSERT to make sure it has M_PKTHDR set.

diffstat:

 sys/net/if_ethersubr.c |  25 ++++++++++++++++---------
 1 files changed, 16 insertions(+), 9 deletions(-)

diffs (73 lines):

diff -r d5594fca3360 -r 2220a71ff4f3 sys/net/if_ethersubr.c
--- a/sys/net/if_ethersubr.c    Fri Oct 04 11:35:44 2019 +0000
+++ b/sys/net/if_ethersubr.c    Tue Oct 08 18:09:41 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_ethersubr.c,v 1.242.6.5 2018/03/13 15:40:25 martin Exp $    */
+/*     $NetBSD: if_ethersubr.c,v 1.242.6.6 2019/10/08 18:09:41 martin Exp $    */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -61,7 +61,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_ethersubr.c,v 1.242.6.5 2018/03/13 15:40:25 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ethersubr.c,v 1.242.6.6 2019/10/08 18:09:41 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -463,10 +463,13 @@
 altq_etherclassify(struct ifaltq *ifq, struct mbuf *m)
 {
        struct ether_header *eh;
+       struct mbuf *mtop = m;
        uint16_t ether_type;
        int hlen, af, hdrsize;
        void *hdr;
 
+       KASSERT((mtop->m_flags & M_PKTHDR) != 0);
+
        hlen = ETHER_HDR_LEN;
        eh = mtod(m, struct ether_header *);
 
@@ -508,7 +511,10 @@
        while (m->m_len <= hlen) {
                hlen -= m->m_len;
                m = m->m_next;
+               if (m == NULL)
+                       goto bad;
        }
+
        if (m->m_len < (hlen + hdrsize)) {
                /*
                 * protocol header not in a single mbuf.
@@ -527,11 +533,12 @@
 
        hdr = mtod(m, void *);
 
-       if (ALTQ_NEEDS_CLASSIFY(ifq))
-               m->m_pkthdr.pattr_class =
+       if (ALTQ_NEEDS_CLASSIFY(ifq)) {
+               mtop->m_pkthdr.pattr_class =
                    (*ifq->altq_classify)(ifq->altq_clfier, m, af);
-       m->m_pkthdr.pattr_af = af;
-       m->m_pkthdr.pattr_hdr = hdr;
+       }
+       mtop->m_pkthdr.pattr_af = af;
+       mtop->m_pkthdr.pattr_hdr = hdr;
 
        m->m_data -= hlen;
        m->m_len += hlen;
@@ -539,9 +546,9 @@
        return;
 
 bad:
-       m->m_pkthdr.pattr_class = NULL;
-       m->m_pkthdr.pattr_hdr = NULL;
-       m->m_pkthdr.pattr_af = AF_UNSPEC;
+       mtop->m_pkthdr.pattr_class = NULL;
+       mtop->m_pkthdr.pattr_hdr = NULL;
+       mtop->m_pkthdr.pattr_af = AF_UNSPEC;
 }
 #endif /* ALTQ */