Author: karels
Date: Tue May 19 01:05:13 2020
New Revision: 361231
URL: https://svnweb.freebsd.org/changeset/base/361231
Log:
Fix NULL-pointer bug from r361228.
Note that in_pcb_lport and in_pcb_lport_dest can be called with a NULL
local address for IPv6 sockets; handle it. Found by syzkaller.
Reported by: cem
MFC after: 1 month
Modified:
head/sys/netinet/in_pcb.c
Modified: head/sys/netinet/in_pcb.c
==============================================================================
--- head/sys/netinet/in_pcb.c Tue May 19 00:15:19 2020 (r361230)
+++ head/sys/netinet/in_pcb.c Tue May 19 01:05:13 2020 (r361231)
@@ -615,6 +615,7 @@ in_pcbbind(struct inpcb *inp, struct sockaddr *nam, st
* Assign a local port like in_pcb_lport(), but also used with connect()
* and a foreign address and port. If fsa is non-NULL, choose a local port
* that is unused with those, otherwise one that is completely unused.
+ * lsa can be NULL for IPv6.
*/
int
in_pcb_lport_dest(struct inpcb *inp, struct sockaddr *lsa, u_short *lportp,
@@ -692,14 +693,17 @@ in_pcb_lport_dest(struct inpcb *inp, struct sockaddr *
#ifdef INET
laddr.s_addr = INADDR_ANY;
if ((inp->inp_vflag & (INP_IPV4|INP_IPV6)) == INP_IPV4) {
- laddr = ((struct sockaddr_in *)lsa)->sin_addr;
+ if (lsa != NULL)
+ laddr = ((struct sockaddr_in *)lsa)->sin_addr;
if (fsa != NULL)
faddr = ((struct sockaddr_in *)fsa)->sin_addr;
}
#endif
#ifdef INET6
- if (lsa->sa_family == AF_INET6) {
- laddr6 = &((struct sockaddr_in6 *)lsa)->sin6_addr;
+ laddr6 = NULL;
+ if ((inp->inp_vflag & INP_IPV6) != 0) {
+ if (lsa != NULL)
+ laddr6 = &((struct sockaddr_in6 *)lsa)->sin6_addr;
if (fsa != NULL)
faddr6 = &((struct sockaddr_in6 *)fsa)->sin6_addr;
}
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
