From nobody Mon Oct 26 19:47:00 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jD3zm6prHz6xWYN for ; Mon, 26 Oct 2026 19:47:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jD3zm3h40z4qhQ for ; Mon, 26 Oct 2026 19:47:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793044020; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rj5dop/f4YWAEASH9iG1b9TIGcT0Fp0POtEOh33pFfA=; b=AP6mY4eGrpiC2yyb6RYBtVqrGALPlP0Lg36xDU8a7qZdz6uN7ii7TM4wO5cRYUjsw0x6A+ ISVVAWuDdPPJc+Hb13Q1NNKWIRcGUWq0XAdJWVSGV8hoIyu6wxoW7o1M3/zNxURu3vBAaR qAbOh6N8Ct1sile5Pph7sRyYB8uWA2PMW4AFVCu5XY4ySutOWYzBuCT7qsGgcHm0mbmbeU WZqn81foWy+ZGtC/9oMVAp6hpTCfo/SwqK7WmbDFIc1Mo/oKKZQiHDSMxGvOhJ7lzRrBQR NcfMofopA2Z6tdRe/+z2qaOb9wxdj19ECyFSzbcLkYaQN3dC2ElbdBq8bwuWEQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793044020; b=AGgM0ACzElI5U6+1+RBlj66e0WobFgM69Mw1Q1UtuBLCx5kHDF94OsehJUvKc+lBjmuPrP jK1yzIEPswgO5hyX5FmSjbOXsplljPTqHS/MjAL/rUk2XoXCmhIA+fagu5MlvbJnpsDmkR VHN1Q7rmes9riESJSUZJkVOcbQrZLfN1K/Z5JbD5/U/y7boPksaJwwslHsqxeOWd7/QODX vjEaJwVGW7Bjq2HXAWw65psqbP1YJZYaVKNl+JAWbb0hRWecv/EHfudFr4yptLQbBA270O gbeDFzqaRGa4C9KH59AxDubLVZoPx5zrgJ+IeQ2v7xa3vSkh72JR1BE9lz8HDg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793044020; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rj5dop/f4YWAEASH9iG1b9TIGcT0Fp0POtEOh33pFfA=; b=Vu82LUnwypTsFvqsXC991d8bh2yOAnVkwzus5V9o4XbTHsaEmYGIRDIYx8Jc00nIbAynZs LqL4zGVTJjAN9iqKULHy4vlkWL6sozKI0M0d/iR22YqrLsDKbphkiKZb0i6u4v0ik7bwg9 AH2x6edFOHnvkE1URC7CFJtTBYVDnK2e5nVZa18IeGBTs2bSxWb/nI/5H12OU33ZCFbbip RoNkPAOe/W8LtX4FTHX280s7gTUYG3LdXEEGj62cd2K5itxbomZb+lPT6RA5WhLeeVZZNE ezr3iVKSIukAa/Sc9axwBS4VIczYFCOgdGWznRngFofFeMrukRpe3pVsavsi5Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jD3zm3JzLzpB2 for ; Mon, 26 Oct 2026 19:47:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 39aaa by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 26 Oct 2026 19:47:00 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 010e61ab37a8 - stable/14 - netinet6: Fix the OSIOCAIFADDR_IN6 handler List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 010e61ab37a83729fe497f8c9d3bb4a45cd76fee Auto-Submitted: auto-generated Date: Mon, 26 Oct 2026 19:47:00 +0000 Message-Id: <6adfae34.39aaa.702a311f@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=010e61ab37a83729fe497f8c9d3bb4a45cd76fee commit 010e61ab37a83729fe497f8c9d3bb4a45cd76fee Author: Mark Johnston AuthorDate: 2026-10-05 13:13:47 +0000 Commit: Mark Johnston CommitDate: 2026-10-26 14:12:15 +0000 netinet6: Fix the OSIOCAIFADDR_IN6 handler We cannot simply treat a pointer to struct oin6_aliasreq as a pointer to struct in6_aliasreq: the latter is larger. In particular, the store to ifra->ifra_vhid is out of bounds. Since OSIOCAIFADDR_IN6 does not need to copy data back out, it can simply use a struct in6_ifaliasreq on the stack. Reported by: Andrew Reviewed by: pouria MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D60184 (cherry picked from commit c109a681456d03fc0737ca83487995e28b759e3b) --- sys/netinet6/in6.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c index fb661ade438d..21a531adc34e 100644 --- a/sys/netinet6/in6.c +++ b/sys/netinet6/in6.c @@ -269,7 +269,7 @@ in6_control_ioctl(u_long cmd, void *data, { struct in6_ifreq *ifr = (struct in6_ifreq *)data; struct in6_ifaddr *ia = NULL; - struct in6_aliasreq *ifra = (struct in6_aliasreq *)data; + struct in6_aliasreq tmpifra, *ifra = (struct in6_aliasreq *)data; struct sockaddr_in6 *sa6; int error; bool control_locked = false; @@ -279,7 +279,9 @@ in6_control_ioctl(u_long cmd, void *data, */ if (cmd == OSIOCAIFADDR_IN6) { cmd = SIOCAIFADDR_IN6; - ifra->ifra_vhid = 0; + ifra = &tmpifra; + memset(ifra, 0, sizeof(*ifra)); + memcpy(ifra, data, sizeof(struct oin6_aliasreq)); } switch (cmd) {