[src/netbsd-7]: src/sys Pull up following revision(s) (requested by bouyer in...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/01d2ab014e06
branches:  netbsd-7
changeset: 454443:01d2ab014e06
user:      martin <martin%NetBSD.org@localhost>
date:      Tue Sep 17 18:07:15 2019 +0000

description:
Pull up following revision(s) (requested by bouyer in ticket #1708):

        sys/netinet6/ip6_input.c: revision 1.209 via patch
        sys/netinet/ip_input.c: revision 1.390 via patch

Packet filters can return an mbuf chain with fragmented headers, so
m_pullup() it if needed and remove the KASSERT()s.

diffstat:

 sys/netinet/ip_input.c   |  21 +++++++++++++++++++--
 sys/netinet6/ip6_input.c |  12 ++++++++++--
 2 files changed, 29 insertions(+), 4 deletions(-)

diffs (77 lines):

diff -r 2bdb96569a67 -r 01d2ab014e06 sys/netinet/ip_input.c
--- a/sys/netinet/ip_input.c    Tue Sep 17 18:04:15 2019 +0000
+++ b/sys/netinet/ip_input.c    Tue Sep 17 18:07:15 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ip_input.c,v 1.319.2.1 2018/02/09 13:37:09 martin Exp $        */
+/*     $NetBSD: ip_input.c,v 1.319.2.2 2019/09/17 18:07:15 martin Exp $        */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -91,7 +91,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.319.2.1 2018/02/09 13:37:09 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.319.2.2 2019/09/17 18:07:15 martin Exp $");
 
 #include "opt_inet.h"
 #include "opt_compat_netbsd.h"
@@ -526,8 +526,25 @@
                if (freed || m == NULL) {
                        return;
                }
+               if (__predict_false(m->m_len < sizeof (struct ip))) {
+                       if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
+                               IP_STATINC(IP_STAT_TOOSMALL);
+                               return;
+                       }
+               }
                ip = mtod(m, struct ip *);
                hlen = ip->ip_hl << 2;
+               if (hlen < sizeof(struct ip)) { /* minimum header length */
+                       IP_STATINC(IP_STAT_BADHLEN);
+                       goto bad;
+               }
+               if (hlen > m->m_len) {
+                       if ((m = m_pullup(m, hlen)) == NULL) {
+                               IP_STATINC(IP_STAT_BADHLEN);
+                               return;
+                       }
+                       ip = mtod(m, struct ip *);
+               }
 
                /*
                 * XXX The setting of "srcrt" here is to prevent ip_forward()
diff -r 2bdb96569a67 -r 01d2ab014e06 sys/netinet6/ip6_input.c
--- a/sys/netinet6/ip6_input.c  Tue Sep 17 18:04:15 2019 +0000
+++ b/sys/netinet6/ip6_input.c  Tue Sep 17 18:07:15 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ip6_input.c,v 1.149.2.3 2018/02/25 23:17:47 snj Exp $  */
+/*     $NetBSD: ip6_input.c,v 1.149.2.4 2019/09/17 18:07:15 martin Exp $       */
 /*     $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $     */
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.149.2.3 2018/02/25 23:17:47 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.149.2.4 2019/09/17 18:07:15 martin Exp $");
 
 #include "opt_gateway.h"
 #include "opt_inet.h"
@@ -352,6 +352,14 @@
                        return;
                if (m == NULL)
                        return;
+               if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
+                       struct ifnet *inifp = m->m_pkthdr.rcvif;
+                       if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
+                               IP6_STATINC(IP6_STAT_TOOSMALL);
+                               in6_ifstat_inc(inifp, ifs6_in_hdrerr);
+                               return;
+                       }
+               }
                ip6 = mtod(m, struct ip6_hdr *);
                srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst);
        }