In arp_rtrequest and nd6_rtrequest return early if the RTF_MPLS flag is

set. These mpls routes use the rt_llinfo structure to store the MPLS label
and would confuse the arp and nd6 code.
OK bluhm@ anton@

Reported-by: syzbot+927e93a362f3ae33dd9c@syzkaller.appspotmail.com

diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c
index 130d107..3e30983 100644 (file)
--- a/sys/netinet/if_ether.c
+++ b/sys/netinet/if_ether.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: if_ether.c,v 1.238 2019/01/20 23:43:13 claudio Exp $  */
+/*     $OpenBSD: if_ether.c,v 1.239 2019/06/13 08:15:26 claudio Exp $  */
 /*     $NetBSD: if_ether.c,v 1.31 1996/05/11 12:59:58 mycroft Exp $    */
 
 /*
@@ -143,7 +143,8 @@ arp_rtrequest(struct ifnet *ifp, int req, struct rtentry *rt)
                timeout_add_sec(&arptimer_to, arpt_prune);
        }
 
-       if (ISSET(rt->rt_flags, RTF_GATEWAY|RTF_BROADCAST|RTF_MULTICAST))
+       if (ISSET(rt->rt_flags,
+           RTF_GATEWAY|RTF_BROADCAST|RTF_MULTICAST|RTF_MPLS))
                return;
 
        switch (req) {

diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c
index f11c067..5ca7c42 100644 (file)
--- a/sys/netinet6/nd6.c
+++ b/sys/netinet6/nd6.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: nd6.c,v 1.226 2018/08/03 09:11:56 florian Exp $       */
+/*     $OpenBSD: nd6.c,v 1.227 2019/06/13 08:15:26 claudio Exp $       */
 /*     $KAME: nd6.c,v 1.280 2002/06/08 19:52:07 itojun Exp $   */
 
 /*
@@ -787,7 +787,7 @@ nd6_rtrequest(struct ifnet *ifp, int req, struct rtentry *rt)
        struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo;
        struct ifaddr *ifa;
 
-       if (ISSET(rt->rt_flags, RTF_GATEWAY|RTF_MULTICAST))
+       if (ISSET(rt->rt_flags, RTF_GATEWAY|RTF_MULTICAST|RTF_MPLS))
                return;
 
        if (nd6_need_cache(ifp) == 0 && (rt->rt_flags & RTF_HOST) == 0) {