git: 010e61ab37a8 - stable/14 - netinet6: Fix the OSIOCAIFADDR_IN6 handler

The branch stable/14 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=010e61ab37a83729fe497f8c9d3bb4a45cd76fee

commit 010e61ab37a83729fe497f8c9d3bb4a45cd76fee
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-10-05 13:13:47 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-26 14:12:15 +0000

    netinet6: Fix the OSIOCAIFADDR_IN6 handler
    
    We cannot simply treat a pointer to struct oin6_aliasreq as a pointer to
    struct in6_aliasreq: the latter is larger.  In particular, the store to
    ifra->ifra_vhid is out of bounds.
    
    Since OSIOCAIFADDR_IN6 does not need to copy data back out, it can
    simply use a struct in6_ifaliasreq on the stack.
    
    Reported by:    Andrew <xxx.sys@protonmail.com>
    Reviewed by:    pouria
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D60184
    
    (cherry picked from commit c109a681456d03fc0737ca83487995e28b759e3b)
---
 sys/netinet6/in6.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c
index fb661ade438d..21a531adc34e 100644
--- a/sys/netinet6/in6.c
+++ b/sys/netinet6/in6.c
@@ -269,7 +269,7 @@ in6_control_ioctl(u_long cmd, void *data,
 {
 	struct	in6_ifreq *ifr = (struct in6_ifreq *)data;
 	struct	in6_ifaddr *ia = NULL;
-	struct	in6_aliasreq *ifra = (struct in6_aliasreq *)data;
+	struct in6_aliasreq tmpifra, *ifra = (struct in6_aliasreq *)data;
 	struct sockaddr_in6 *sa6;
 	int error;
 	bool control_locked = false;
@@ -279,7 +279,9 @@ in6_control_ioctl(u_long cmd, void *data,
 	 */
 	if (cmd == OSIOCAIFADDR_IN6) {
 		cmd = SIOCAIFADDR_IN6;
-		ifra->ifra_vhid = 0;
+		ifra = &tmpifra;
+		memset(ifra, 0, sizeof(*ifra));
+		memcpy(ifra, data, sizeof(struct oin6_aliasreq));
 	}
 
 	switch (cmd) {