⬢ DragonFlyBSD Kernel Audit
DF-2587 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
diff --git a/sys/netgraph/ether/ng_ether.c b/sys/netgraph/ether/ng_ether.c
@@ -204,7 +204,12 @@
 ng_ether_input(struct ifnet *ifp, struct mbuf **mp)
 {
 	const node_p node = IFP2NG(ifp);
-	const priv_p priv = node->private;
+	priv_p priv;
+
+	/* No netgraph node attached (attach failed / detach racing) */
+	if (node == NULL)
+		return;
+	priv = node->private;
 
 	/* If "lower" hook not connected, let packet continue */
 	if (priv->lower == NULL || priv->lowerOrphan)
@@ -220,7 +225,14 @@
 ng_ether_input_orphan(struct ifnet *ifp, struct mbuf *m)
 {
 	const node_p node = IFP2NG(ifp);
-	const priv_p priv = node->private;
+	priv_p priv;
+
+	/* No netgraph node attached (attach failed / detach racing) */
+	if (node == NULL) {
+		m_freem(m);
+		return;
+	}
+	priv = node->private;
 
 	/* If "orphan" hook not connected, let packet continue */
 	if (priv->lower == NULL || !priv->lowerOrphan) {
@@ -258,10 +270,15 @@
 ng_ether_output(struct ifnet *ifp, struct mbuf **mp)
 {
 	const node_p node = IFP2NG(ifp);
-	const priv_p priv = node->private;
+	priv_p priv;
 	meta_p meta = NULL;
 	int error = 0;
 
+	/* No netgraph node attached (attach failed / detach racing) */
+	if (node == NULL)
+		return (0);
+	priv = node->private;
+
 	/* If "upper" hook not connected, let packet continue */
 	if (priv->upper == NULL)
 		return (0);