nd6: Set ip6 after m_pullup() in nd6_ra_input()

nd6_ra_input() reads the IPv6 header pointer ip6 before m_pullup(), then
uses that pointer afterwards to set nd_ra.

When m_pullup() relocates the chain it frees the original first mbuf and
returns a new one, leaving ip6 dangling; the subsequent access may be a
use-after-free read.

The fix writes ip6 from the returned mbuf after m_pullup() inside the
conditional if.

Reviewed by: pouria
Differential Revision: https://reviews.freebsd.org/D58229

1 files changed, 1 insertions, 0 deletions

diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c
index 041fd25865ab..4004a23308d1 100644
--- a/sys/netinet6/nd6_rtr.c
+++ b/sys/netinet6/nd6_rtr.c
@@ -556,6 +556,7 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len)
 			IP6STAT_INC(ip6s_exthdrtoolong);
 			return;
 		}
+		ip6 = mtod(m, struct ip6_hdr *);
 	}
 	nd_ra = (struct nd_router_advert *)((caddr_t)ip6 + off);