Return mbuf pointer or NULL from ip_fastforward() as the mbuf pointer

may have changed by m_pullup() during fastforward processing.

While this is a bug it is actually never triggered in real world
situations and it is not remotely exploitable.

Found by:	Coverity Prevent(tm)
Coverity ID:	CID780
Sponsored by:	TCP/IP Optimization Fundraise 2005

7 files changed, 8 insertions, 8 deletions

diff --git a/sys/net/if_arcsubr.c b/sys/net/if_arcsubr.c
index 6cdb951..f3c00cd 100644
--- a/sys/net/if_arcsubr.c
+++ b/sys/net/if_arcsubr.c
@@ -559,14 +559,14 @@ arc_input(ifp, m)
 #ifdef INET
 	case ARCTYPE_IP:
 		m_adj(m, ARC_HDRNEWLEN);
-		if (ip_fastforward(m))
+		if ((m = ip_fastforward(m)) == NULL)
 			return;
 		isr = NETISR_IP;
 		break;
 
 	case ARCTYPE_IP_OLD:
 		m_adj(m, ARC_HDRLEN);
-		if (ip_fastforward(m))
+		if ((m = ip_fastforward(m)) == NULL)
 			return;
 		isr = NETISR_IP;
 		break;
diff --git a/sys/net/if_ef.c b/sys/net/if_ef.c
index 04262c6..19c1687 100644
--- a/sys/net/if_ef.c
+++ b/sys/net/if_ef.c
@@ -247,7 +247,7 @@ ef_inputEII(struct mbuf *m, struct ether_header *eh, u_short ether_type)
 #endif
 #ifdef INET
 	case ETHERTYPE_IP:
-		if (ip_fastforward(m))
+		if ((m = ip_fastforward(m)) == NULL)
 			return (0);
 		isr = NETISR_IP;
 		break;
diff --git a/sys/net/if_ethersubr.c b/sys/net/if_ethersubr.c
index d96b48bf..9a5ffc3 100644
--- a/sys/net/if_ethersubr.c
+++ b/sys/net/if_ethersubr.c
@@ -741,7 +741,7 @@ post_stats:
 	switch (ether_type) {
 #ifdef INET
 	case ETHERTYPE_IP:
-		if (ip_fastforward(m))
+		if ((m = ip_fastforward(m)) == NULL)
 			return;
 		isr = NETISR_IP;
 		break;
diff --git a/sys/net/if_fddisubr.c b/sys/net/if_fddisubr.c
index d7c3e33..cc4b1fc 100644
--- a/sys/net/if_fddisubr.c
+++ b/sys/net/if_fddisubr.c
@@ -495,7 +495,7 @@ fddi_input(ifp, m)
 		switch (type) {
 #ifdef INET
 		case ETHERTYPE_IP:
-			if (ip_fastforward(m))
+			if ((m = ip_fastforward(m)) == NULL)
 				return;
 			isr = NETISR_IP;
 			break;
diff --git a/sys/net/if_fwsubr.c b/sys/net/if_fwsubr.c
index 4846b27..7cf1c22 100644
--- a/sys/net/if_fwsubr.c
+++ b/sys/net/if_fwsubr.c
@@ -601,7 +601,7 @@ firewire_input(struct ifnet *ifp, struct mbuf *m, uint16_t src)
 	switch (type) {
 #ifdef INET
 	case ETHERTYPE_IP:
-		if (ip_fastforward(m))
+		if ((m = ip_fastforward(m)) == NULL)
 			return;
 		isr = NETISR_IP;
 		break;
diff --git a/sys/net/if_iso88025subr.c b/sys/net/if_iso88025subr.c
index 5d5a3a2..14c6f98 100644
--- a/sys/net/if_iso88025subr.c
+++ b/sys/net/if_iso88025subr.c
@@ -583,7 +583,7 @@ iso88025_input(ifp, m)
 #ifdef INET
 		case ETHERTYPE_IP:
 			th->iso88025_shost[0] &= ~(TR_RII); 
-			if (ip_fastforward(m))
+			if ((m = ip_fastforward(m)) == NULL)
 				return;
 			isr = NETISR_IP;
 			break;
diff --git a/sys/net/if_ppp.c b/sys/net/if_ppp.c
index 7bf26f3..4d410d4 100644
--- a/sys/net/if_ppp.c
+++ b/sys/net/if_ppp.c
@@ -1570,7 +1570,7 @@ ppp_inproc(sc, m)
 	m->m_pkthdr.len -= PPP_HDRLEN;
 	m->m_data += PPP_HDRLEN;
 	m->m_len -= PPP_HDRLEN;
-	if (ip_fastforward(m))
+	if ((m = ip_fastforward(m)) == NULL)
 	    return;
 	isr = NETISR_IP;
 	break;