Under some circumstances, the loopback interface will allocate a new

mbuf for a packet looping back to provide alignment guarantees for
KAME.  Unfortunately, this code performs a direct copy of the header
rather than using a header copying primitive (largely because we have
sucky header copying primitives).  This results in a multiple free
of the MAC label in the header when the same label data is freed
twice when the two mbufs with that header are freed.  As a temporary
work-around, clear the initialized flag on the label to prevent the
duplicate free, which prevents panics on large unaligned loopback
IP and IPv6 data.  The real fix is to improve and make use of proper
packet header copying routines here.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

1 files changed, 10 insertions, 0 deletions

diff --git a/sys/net/if_loop.c b/sys/net/if_loop.c
index b4fc8b5..9c3affc 100644
--- a/sys/net/if_loop.c
+++ b/sys/net/if_loop.c
@@ -42,10 +42,12 @@
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipx.h"
+#include "opt_mac.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
+#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/module.h>
@@ -225,6 +227,14 @@ looutput(ifp, m, dst, rt)
 		n->m_pkthdr = m->m_pkthdr;
 		n->m_len = m->m_pkthdr.len;
 		SLIST_INIT(&m->m_pkthdr.tags);
+#ifdef MAC
+		/* 
+		 * XXXMAC: Once we put labels in tags and proper
+		 * primitives are used for relocating mbuf header
+		 * data, this will no longer be required.
+		 */
+		m->m_pkthdr.label.l_flags &= ~MAC_FLAG_INITIALIZED;
+#endif
 		m_freem(m);
 		m = n;
 	}