HomeFreeBSD

nd6: fix panic in lltable_drop_entry_queue()

Description

nd6: fix panic in lltable_drop_entry_queue()

nd6_resolve_slow() can be called without mbuf. If the LLE entry
is not reachable, nd6_resolve_slow() will add this NULL mbuf to
the holdchain via lltable_append_entry_queue, which will "append"
NULL to the end of the queue (effectively no-op) and bump la_numhold
value. When this entry gets freed, the kernel will panic due to the
inconsistency between the amount of mbufs in the queue and the value
of la_numhold.

Fix the panic by checking of mbuf is not NULL prior to inserting it
into the holdchain.

Reported by: kib
MFC after: 3 days

Details

Provenance
melifaroAuthored on Jan 15 2023, 3:10 PM
Parents
rGb0286ee504c6: man: add Netlink reference to socket(2)
Branches
Unknown
Tags
Unknown