Fix a panic where if the mbuf was consumed by the filter for requeueing

(dummynet), ipsec_filter() would return the empty error code and the ipsec code
would continue to forward/deference the null mbuf.

Found by:       m0n0wall
Reviewed by:    bz
MFC after:      3 days

1 files changed, 7 insertions, 0 deletions

diff --git a/sys/net/if_enc.c b/sys/net/if_enc.c
index 3ab9081..94d887f 100644
--- a/sys/net/if_enc.c
+++ b/sys/net/if_enc.c
@@ -293,6 +293,13 @@ ipsec_filter(struct mbuf **mp, int dir, int flags)
 			printf("%s: unknown IP version\n", __func__);
 	}
 
+	/*
+	 * If the mbuf was consumed by the filter for requeueing (dummynet, etc)
+	 * then error will be zero but we still want to return an error to our
+	 * caller so the null mbuf isn't forwarded further.
+	 */
+	if (*mp == NULL && error == 0)
+		return (-1);	/* Consumed by the filter */
 	if (*mp == NULL)
 		return (error);
 	if (error != 0)