Author: gordon
Date: Tue May 14 23:10:21 2019
New Revision: 347591
URL: https://svnweb.freebsd.org/changeset/base/347591
Log:
Fix IPv6 fragment reassembly panic in pf
Approved by: so
Security: FreeBSD-SA-19:05.pf
Security: CVE-2019-5597
Modified:
releng/11.2/sys/netpfil/pf/pf_norm.c
releng/12.0/sys/netpfil/pf/pf_norm.c
Modified: releng/11.2/sys/netpfil/pf/pf_norm.c
==============================================================================
--- releng/11.2/sys/netpfil/pf/pf_norm.c Tue May 14 23:06:26 2019
(r347590)
+++ releng/11.2/sys/netpfil/pf/pf_norm.c Tue May 14 23:10:21 2019
(r347591)
@@ -652,11 +652,11 @@ pf_reassemble6(struct mbuf **m0, struct ip6_hdr *ip6,
}
/* We have all the data. */
+ frent = TAILQ_FIRST(&frag->fr_queue);
+ KASSERT(frent != NULL, ("frent != NULL"));
extoff = frent->fe_extoff;
maxlen = frag->fr_maxlen;
frag_id = frag->fr_id;
- frent = TAILQ_FIRST(&frag->fr_queue);
- KASSERT(frent != NULL, ("frent != NULL"));
total = TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_off +
TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_len;
hdrlen = frent->fe_hdrlen - sizeof(struct ip6_frag);
Modified: releng/12.0/sys/netpfil/pf/pf_norm.c
==============================================================================
--- releng/12.0/sys/netpfil/pf/pf_norm.c Tue May 14 23:06:26 2019
(r347590)
+++ releng/12.0/sys/netpfil/pf/pf_norm.c Tue May 14 23:10:21 2019
(r347591)
@@ -668,11 +668,11 @@ pf_reassemble6(struct mbuf **m0, struct ip6_hdr *ip6,
}
/* We have all the data. */
+ frent = TAILQ_FIRST(&frag->fr_queue);
+ KASSERT(frent != NULL, ("frent != NULL"));
extoff = frent->fe_extoff;
maxlen = frag->fr_maxlen;
frag_id = frag->fr_id;
- frent = TAILQ_FIRST(&frag->fr_queue);
- KASSERT(frent != NULL, ("frent != NULL"));
total = TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_off +
TAILQ_LAST(&frag->fr_queue, pf_fragq)->fe_len;
hdrlen = frent->fe_hdrlen - sizeof(struct ip6_frag);
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
