From nobody Thu Oct 08 23:56:55 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j16NX5ZFVz6Z0Rj for ; Thu, 08 Oct 2026 23:57:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j16NX554wz4Hkt for ; Thu, 08 Oct 2026 23:57:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791503820; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1ezCn4BNzZZ/YCkuUYshx32CF28NB1a4ZRXvE3SFQg4=; b=RhRHDc4I+U0+SjcGo74H2K62L9GKDszOQ1wlruwZL6zFgNkwsrribVOA05ulLgX4j+J16P 2Z1mwN2PhnWvnuXgJ3pkAbJ5aQkQsBhDMnogZKjObFaB+9n5rrrwMSPOsjH7wBRvUo94hO 3js5t7Eugp6o028tY1mf9LER5HVp1x6vcaW51AMuAbmFbHQqH3vcxkt01Fm3EqOZwjjM1k cKcd5lRv0KRMTeAsiQJIhv4ziaUSB1+l2ZknvhUcR5N6OdmNXVgqhdJeYXuuIZY9B+g71r ESxZpc4b7b4bauGSsKSP8rOLwo13WAmwOKUchHDxoM8GQ8K1wY9YB3WfpTyF/w== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791503820; b=YyUsfLuJy+Hl3AMhb3R+9bXeG5/3vPd4XKEp11yI61kXJQWCI2pXxoweedWwYDXSrvHhyU qicay8jqtgsiznUa4y5VZl2EkyUpYlmaBHh1YyONPgOaKmd81el3xr7VQ8+JiOJYn1859l 4KlxRXSi+px9dVRLVBBRi8T0iuDxr5UyMoHdN0SNNPvXi4Bc+kW0ZBElrPy6x9Eh5aCSpQ HAwbNH58a3ySJajpa4d+PTJ1DJx9P/BgWsWyLMCL6NbudpLyEBdKIco/DhaSxJxYCgdyTX 66V0sJYeQbDG9inRLri6fZQk2qhE4P7szThJFZLuXLoCWcVFMFMYXbzFedVDuw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791503820; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1ezCn4BNzZZ/YCkuUYshx32CF28NB1a4ZRXvE3SFQg4=; b=IQvdDIqKP9WsNRlu6R44MxhvrpQ4RF/LyCVNYeeNvG/K5+hpcdCg7ylh5GYavZ5zjoxtcv HSFj1cwe5+vYhZ+vCOXXiCE9xiX4fKB2cd7letPHIxACwgFdnBTsKdQzr0dnl0gkO5p9oX AVnzjtfU393JRXXFcHWx3PFEA9NGS+tJPzi4lRpjKrTI2ma4F+EOGNRvoygj2+2mcT3iIX cN6NNj+kbF5ZywOkeseWpu/u9giUYKRC/H9jrrcgZlE/2qSQpid/lCI3s9TKwAn4zK3s6h nZyPFvWyeSDrQRliTFxqtR45ng2e7Ow6vXzAeehUfjZ+HoyPVVp4ypEQ8vCYZw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j16NX48JDz12LT for ; Thu, 08 Oct 2026 23:57:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46f2d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 08 Oct 2026 23:56:55 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: R. Christian McDonald Subject: git: ec76d3f600b5 - main - nd6: Do not allocate an ifaddr for the interface ID in in6_ifadd() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ec76d3f600b528df7c29d3305e44342f08789fbf Auto-Submitted: auto-generated Date: Thu, 08 Oct 2026 23:56:55 +0000 Message-Id: <6ac82dc7.46f2d.35ee6d75@gitrepo.freebsd.org> The branch main has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=ec76d3f600b528df7c29d3305e44342f08789fbf commit ec76d3f600b528df7c29d3305e44342f08789fbf Author: R. Christian McDonald AuthorDate: 2026-10-08 23:08:19 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-08 23:08:19 +0000 nd6: Do not allocate an ifaddr for the interface ID in in6_ifadd() Without a suitable link-local address, in6_ifadd() obtains the interface identifier from in6_get_ifid(). It wrote the result into a freshly allocated struct in6_ifaddr, M_NOWAIT since the function runs in the network epoch, so SLAAC could fail under memory pressure over a 16 byte scratch buffer. Write the identifier into the on-stack address the rest of the function uses instead. Zero it first, in6_get_ifid() only fills in the low 64 bits, as the M_ZERO allocation did. Track which path provided the identifier with a flag instead of a pointer into the ifaddr, so each path releases its own reference. Reviewed by: glebius Fixes: 9e792f7ef729 ("sys/netinet6: Fix SLAAC for interfaces with no /64 LL address") Fixes: f9fc93690aef ("sys/netinet6: fix memory corruption in in6_ifadd") MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D60488 --- sys/netinet6/nd6_rtr.c | 50 +++++++++++++++++++++----------------------------- 1 file changed, 21 insertions(+), 29 deletions(-) diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c index 9d7cd3f832d9..ed31981ec9df 100644 --- a/sys/netinet6/nd6_rtr.c +++ b/sys/netinet6/nd6_rtr.c @@ -1215,7 +1215,7 @@ in6_ifadd(struct nd_prefixctl *pr, int mcast) struct in6_aliasreq ifra; struct in6_ifaddr *ia = NULL, *ib = NULL; int error, plen0; - struct in6_addr *ifid_addr = NULL, mask, newaddr; + struct in6_addr mask, newaddr; int prefixlen = pr->ndpr_plen; int updateflags; char ip6buf[INET6_ADDRSTRLEN]; @@ -1255,47 +1255,39 @@ in6_ifadd(struct nd_prefixctl *pr, int mcast) if(!in6_get_stableifid(ifp, &newaddr, prefixlen)) return NULL; } else { + bool have_ifid = false; + ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 0); /* 0 is OK? */ - if (ifa) { + if (ifa != NULL) { ib = (struct in6_ifaddr *)ifa; - ifid_addr = &ib->ia_addr.sin6_addr; /* prefixlen + ifidlen must be equal to 128 */ plen0 = in6_mask2len(&ib->ia_prefixmask.sin6_addr, NULL); - if (prefixlen != plen0) { - ifa_free(ifa); - ifid_addr = NULL; + if (prefixlen == plen0) { + memcpy(&newaddr, &ib->ia_addr.sin6_addr, + sizeof(newaddr)); + have_ifid = true; + } else { nd6log((LOG_DEBUG, "%s: wrong prefixlen for %s (prefix=%d ifid=%d)\n", __func__, if_name(ifp), prefixlen, 128 - plen0)); } + ifa_free(ifa); } - /* No suitable LL address, get the ifid directly */ - if (ifid_addr == NULL) { - ifa = ifa_alloc(sizeof(struct in6_ifaddr), M_NOWAIT); - if (ifa != NULL) { - ib = (struct in6_ifaddr *)ifa; - ifid_addr = &ib->ia_addr.sin6_addr; - if(in6_get_ifid(ifp, NULL, ifid_addr) != 0) { - nd6log((LOG_DEBUG, - "%s: failed to get ifid for %s\n", - __func__, if_name(ifp))); - ifa_free(ifa); - ifid_addr = NULL; - } + /* + * No suitable link-local address, get the ifid directly. + * Only the low 64 bits are filled in, zero the rest. + */ + if (!have_ifid) { + memset(&newaddr, 0, sizeof(newaddr)); + if (in6_get_ifid(ifp, NULL, &newaddr) != 0) { + nd6log((LOG_INFO, + "%s: could not determine ifid for %s\n", + __func__, if_name(ifp))); + return (NULL); } } - - if (ifid_addr == NULL) { - nd6log((LOG_INFO, - "%s: could not determine ifid for %s\n", - __func__, if_name(ifp))); - return NULL; - } - - memcpy(&newaddr, &ib->ia_addr.sin6_addr, sizeof(ib->ia_addr.sin6_addr)); - ifa_free(ifa); } IN6_MASK_ADDR(&ifra.ifra_addr.sin6_addr, &mask);