m_dup1() copies the packet header and allocates the mbuf cluster in the wrong order. M_DUP_PKTHDR needs to be called with an empty mbuf. Allocating an mbuf cluster beforehand is not allowed as the resulting mbuf is no longer considered empty (part of the header is initialized). The correct order is to allocate an mbuf via MGETHDR(), copy the packet header and as last step allocate the cluster. Issue found by JINMEI Tatuya. OK canacar@ deraadt@ mglocker@ additional input itojun@
m_dup1() copies the packet header and allocates the mbuf cluster in the
wrong order. M_DUP_PKTHDR needs to be called with an empty mbuf.
Allocating an mbuf cluster beforehand is not allowed as the resulting mbuf is
no longer considered empty (part of the header is initialized).
The correct order is to allocate an mbuf via MGETHDR(), copy the packet header
and as last step allocate the cluster.
Issue found by JINMEI Tatuya.
OK canacar@ deraadt@ mglocker@ additional input itojun@

orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars