From 54e675342b5d05b49928ab95e10fcbbd794206d2 Mon Sep 17 00:00:00 2001
From: "Jonathan T. Looney" <jtl@FreeBSD.org>
Date: Fri, 2 Nov 2018 19:14:15 +0000
Subject: [PATCH] m_pulldown() may reallocate n. Update the oip pointer after
 the m_pulldown() call.

MFC after:	2 weeks
Sponsored by:	Netflix
---
 sys/netinet/ip_icmp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c
index 123cf7e44fd..5dd66dab24d 100644
--- a/sys/netinet/ip_icmp.c
+++ b/sys/netinet/ip_icmp.c
@@ -264,6 +264,7 @@ icmp_error(struct mbuf *n, int type, int code, uint32_t dest, int mtu)
 		if (n->m_len < oiphlen + tcphlen &&
 		    (n = m_pullup(n, oiphlen + tcphlen)) == NULL)
 			goto freeit;
+		oip = mtod(n, struct ip *);
 		icmpelen = max(tcphlen, min(V_icmp_quotelen,
 		    ntohs(oip->ip_len) - oiphlen));
 	} else if (oip->ip_p == IPPROTO_SCTP) {