git: 1802e8fa3364 - stable/14 - netinet6/nd6: Sprinkle missing prefix refcounting

The branch stable/14 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=1802e8fa3364dd6c744e0edb2e5815244938032d

commit 1802e8fa3364dd6c744e0edb2e5815244938032d
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-24 20:05:06 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-08-05 15:15:14 +0000

    netinet6/nd6: Sprinkle missing prefix refcounting
    
    When we drop the prefix lock to call nd6_prefix_offlink() or
    nd6_prefix_onlink(), make sure to keep the correpsonding prefix
    structure alive.  It is possible for a concurrent nd6_timer() to expire
    the prefix while the lock is dropped.
    
    Reported by:    Maik Muench of Secfault Security
    Reviewed by:    pouria, zlei
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58423
    
    (cherry picked from commit 76ca489e0f147e9bd90408ea562087e84ed6f479)
---
 sys/netinet6/nd6_rtr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c
index eeecbe2c70c4..d8395bc711c4 100644
--- a/sys/netinet6/nd6_rtr.c
+++ b/sys/netinet6/nd6_rtr.c
@@ -1888,6 +1888,7 @@ restart:
 		flags = pr->ndpr_stateflags & (NDPRF_DETACHED | NDPRF_ONLINK);
 		if (flags == 0 || flags == (NDPRF_DETACHED | NDPRF_ONLINK)) {
 			genid = V_nd6_list_genid;
+			nd6_prefix_ref(pr);
 			ND6_RUNLOCK();
 			if ((flags & NDPRF_ONLINK) != 0 &&
 			    (e = nd6_prefix_offlink(pr)) != 0) {
@@ -1906,6 +1907,7 @@ restart:
 					    &pr->ndpr_prefix.sin6_addr),
 					    pr->ndpr_plen, e));
 			}
+			nd6_prefix_rele(pr);
 			ND6_RLOCK();
 			if (genid != V_nd6_list_genid)
 				goto restart;
@@ -2168,6 +2170,7 @@ restart:
 				int e;
 
 				genid = V_nd6_list_genid;
+				nd6_prefix_ref(opr);
 				ND6_RUNLOCK();
 				if ((e = nd6_prefix_onlink(opr)) != 0) {
 					nd6log((LOG_ERR,
@@ -2179,6 +2182,7 @@ restart:
 					    if_name(opr->ndpr_ifp), e));
 				} else
 					a_failure = 0;
+				nd6_prefix_rele(opr);
 				ND6_RLOCK();
 				if (genid != V_nd6_list_genid)
 					goto restart;