K 10
svn:author
V 2
bz
K 8
svn:date
V 27
2020-01-08T15:41:04.686891Z
K 7
svn:log
V 717
MFC r353635 (by hselasky):

  Fix panic in network stack due to use after free when receiving
  partial fragmented packets before a network interface is detached.

  When sending IPv4 or IPv6 fragmented packets and a fragment is lost
  before the network device is freed, the mbuf making up the fragment
  will remain in the temporary hashed fragment list and cause a panic
  when it times out due to accessing a freed network interface
  structure.

  1) Make sure the m_pkthdr.rcvif always points to a valid network
  interface. Else the rcvif field should be set to NULL.

  2) Use the rcvif of the last received fragment as m_pkthdr.rcvif for
  the fully defragged packet, instead of the first received fragment.

END