NetBSD Problem Report #60484

From www@netbsd.org  Thu Jul 23 16:49:34 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 6E3BB1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 23 Jul 2026 16:49:34 +0000 (UTC)
Message-Id: <20260723164932.9E2281A923C@mollari.NetBSD.org>
Date: Thu, 23 Jul 2026 16:49:32 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: ipfilter: null pointer deref in icmp6 parsing
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60484
>Category:       kern
>Synopsis:       ipfilter: null pointer deref in icmp6 parsing
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          pending-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 23 16:50:01 +0000 2026
>Closed-Date:    
>Last-Modified:  Sun Aug 02 13:25:03 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The NetBSD Filtration, Ipf.
>Environment:
>Description:

	If ipfilter keeps state, feeding it a ICMP6 error packet with
	an encapsulated ICMP6 error packet may lead to a null pointer
	dereference, crashing the kernel.

   4364 ipf_checkicmp6matchingstate(fr_info_t *fin)
   4365 {
...
   4394 	oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN);
...
   4404 	ofin.fin_m = NULL;	/* if dereferenced, panic XXX */
   4405 	ofin.fin_mp = NULL;	/* if dereferenced, panic XXX */
...
   4420 	ofin.fin_ip = (ip_t *)oip6;
...
   4421 	(void) ipf_makefrip(sizeof(*oip6), (ip_t *)oip6, &ofin);

https://nxr.netbsd.org/xref/src/sys/external/bsd/ipf/netinet/ip_state.c?r=1.12#4353

   2033 ipf_makefrip(int hlen, ip_t *ip, fr_info_t *fin)
   2034 {
...
   2052 	} else if (v == 6) {
   2053 		fin->fin_plen = ntohs(((ip6_t *)ip)->ip6_plen);
   2054 		fin->fin_dlen = fin->fin_plen;
   2055 		fin->fin_plen += hlen;
   2056 
   2057 		ipf_pr_ipv6hdr(fin);

https://nxr.netbsd.org/xref/src/sys/external/bsd/ipf/netinet/fil.c?r=1.37#2020

    472 ipf_pr_ipv6hdr(fr_info_t *fin)
    473 {
...
    516 		case IPPROTO_ICMPV6 :
    517 			ipf_pr_icmp6(fin);

https://nxr.netbsd.org/xref/src/sys/external/bsd/ipf/netinet/fil.c?r=1.37#460

    905 ipf_pr_icmp6(fr_info_t *fin)
    906 {
...
    917 	if (fin->fin_dlen > 1) {
...
    927 		switch (icmp6->icmp6_type)
    928 		{
...
    936 		case ICMP6_DST_UNREACH :
    937 		case ICMP6_PACKET_TOO_BIG :
    938 		case ICMP6_TIME_EXCEEDED :
    939 		case ICMP6_PARAM_PROB :
...
 => 945 			if (M_LEN(fin->fin_m) < fin->fin_plen) {
    946 				if (ipf_coalesce(fin) != 1)
    947 					return;
    948 			}

https://nxr.netbsd.org/xref/src/sys/external/bsd/ipf/netinet/fil.c?r=1.37#895

	Forwarded to us by Chris Jarrett-Davies <chrisjd@openai.com>.

>How-To-Repeat:

	1. configure state and exchange packets creating state entries
	2. send an ICMP6 error with an encapsulated ICMP6 error

>Fix:

	Check fin->fin_m == NULL first.

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60484 CVS commit: src/tests/ipf
Date: Thu, 23 Jul 2026 16:57:52 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Thu Jul 23 16:57:52 UTC 2026

 Modified Files:
 	src/tests/ipf: t_filter_exec.sh
 	src/tests/ipf/expected: ipv6.3
 	src/tests/ipf/input: ipv6.3

 Log Message:
 ipfilter: Test icmp6 packet of death.

 PR kern/60484: ipfilter: null pointer deref in icmp6 parsing


 To generate a diff of this commit:
 cvs rdiff -u -r1.8 -r1.9 src/tests/ipf/t_filter_exec.sh
 cvs rdiff -u -r1.1 -r1.2 src/tests/ipf/expected/ipv6.3
 cvs rdiff -u -r1.2 -r1.3 src/tests/ipf/input/ipv6.3

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60484 CVS commit: src
Date: Thu, 23 Jul 2026 16:58:51 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Thu Jul 23 16:58:51 UTC 2026

 Modified Files:
 	src/sys/external/bsd/ipf/netinet: fil.c
 	src/tests/ipf: t_filter_exec.sh

 Log Message:
 ipfilter: Don't choke on an ICMP6 error quoting an ICMP6 error.

 PR kern/60484: ipfilter: null pointer deref in icmp6 parsing


 To generate a diff of this commit:
 cvs rdiff -u -r1.37 -r1.38 src/sys/external/bsd/ipf/netinet/fil.c
 cvs rdiff -u -r1.9 -r1.10 src/tests/ipf/t_filter_exec.sh

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Thu, 23 Jul 2026 21:03:22 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10, pullup-9


State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sat, 25 Jul 2026 19:47:32 +0000
State-Changed-Why:
pullup-11 #397 https://releng.netbsd.org/cgi-bin/req-11.cgi?show=397
pullup-10 #1317 https://releng.netbsd.org/cgi-bin/req-10.cgi?show=1317
pullpu-9 #2039 https://releng.netbsd.org/cgi-bin/req-9.cgi?show=2039


From: "Stephen Borrill" <sborrill@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60484 CVS commit: [netbsd-9] src
Date: Tue, 28 Jul 2026 11:22:58 +0000

 Module Name:	src
 Committed By:	sborrill
 Date:		Tue Jul 28 11:22:58 UTC 2026

 Modified Files:
 	src/sys/external/bsd/ipf/netinet [netbsd-9]: fil.c
 	src/tests/ipf/expected [netbsd-9]: ipv6.3
 	src/tests/ipf/input [netbsd-9]: ipv6.3

 Log Message:
 Pull up the following revisions(s) (requested by riastradh in ticket #2039):
 	sys/external/bsd/ipf/netinet/fil.c:	revision 1.38
 	tests/ipf/t_filter_exec.sh:	revision 1.9
 	tests/ipf/expected/ipv6.3:	revision 1.2
 	tests/ipf/input/ipv6.3:	revision 1.3
 	tests/ipf/t_filter_exec.sh:	revision 1.10

 ipfilter: Fix remotely triggerable null pointer dereference and
 add an automatic test for it.
 PR kern/60484: ipfilter: null pointer deref in icmp6 parsing


 To generate a diff of this commit:
 cvs rdiff -u -r1.29.2.3 -r1.29.2.4 src/sys/external/bsd/ipf/netinet/fil.c
 cvs rdiff -u -r1.1 -r1.1.50.1 src/tests/ipf/expected/ipv6.3
 cvs rdiff -u -r1.2 -r1.2.34.1 src/tests/ipf/input/ipv6.3

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Stephen Borrill" <sborrill@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60484 CVS commit: [netbsd-10] src
Date: Tue, 28 Jul 2026 13:31:07 +0000

 Module Name:	src
 Committed By:	sborrill
 Date:		Tue Jul 28 13:31:07 UTC 2026

 Modified Files:
 	src/sys/external/bsd/ipf/netinet [netbsd-10]: fil.c
 	src/tests/ipf/expected [netbsd-10]: ipv6.3
 	src/tests/ipf/input [netbsd-10]: ipv6.3

 Log Message:
 Pull up the following revisions(s) (requested by riastradh in ticket #1317):
 	sys/external/bsd/ipf/netinet/fil.c:	revision 1.38
 	tests/ipf/t_filter_exec.sh:	revision 1.9
 	tests/ipf/expected/ipv6.3:	revision 1.2
 	tests/ipf/input/ipv6.3:	revision 1.3
 	tests/ipf/t_filter_exec.sh:	revision 1.10

 ipfilter: Fix remotely triggerable null pointer dereference and
 add an automatic test for it.
 PR kern/60484: ipfilter: null pointer deref in icmp6 parsing


 To generate a diff of this commit:
 cvs rdiff -u -r1.35 -r1.35.4.1 src/sys/external/bsd/ipf/netinet/fil.c
 cvs rdiff -u -r1.1 -r1.1.58.1 src/tests/ipf/expected/ipv6.3
 cvs rdiff -u -r1.2 -r1.2.42.1 src/tests/ipf/input/ipv6.3

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60484 CVS commit: [netbsd-11] src
Date: Sun, 2 Aug 2026 13:24:35 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Sun Aug  2 13:24:34 UTC 2026

 Modified Files:
 	src/sys/external/bsd/ipf/netinet [netbsd-11]: fil.c
 	src/tests/ipf/expected [netbsd-11]: ipv6.3
 	src/tests/ipf/input [netbsd-11]: ipv6.3

 Log Message:
 Pull up following revision(s) (requested by riastradh in ticket #397):

 	tests/ipf/t_filter_exec.sh: revision 1.10
 	tests/ipf/t_filter_exec.sh: revision 1.9
 	sys/external/bsd/ipf/netinet/fil.c: revision 1.38
 	tests/ipf/input/ipv6.3: revision 1.3
 	tests/ipf/expected/ipv6.3: revision 1.2

 ipfilter: Test icmp6 packet of death.
 PR kern/60484: ipfilter: null pointer deref in icmp6 parsing

 ipfilter: Don't choke on an ICMP6 error quoting an ICMP6 error.
 PR kern/60484: ipfilter: null pointer deref in icmp6 parsing


 To generate a diff of this commit:
 cvs rdiff -u -r1.37 -r1.37.8.1 src/sys/external/bsd/ipf/netinet/fil.c
 cvs rdiff -u -r1.1 -r1.1.62.1 src/tests/ipf/expected/ipv6.3
 cvs rdiff -u -r1.2 -r1.2.46.1 src/tests/ipf/input/ipv6.3

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search