git: 76ca489e0f14 - main - netinet6/nd6: Sprinkle missing prefix refcounting

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=76ca489e0f147e9bd90408ea562087e84ed6f479

commit 76ca489e0f147e9bd90408ea562087e84ed6f479
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-24 20:05:06 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-07-24 20:05:06 +0000

    netinet6/nd6: Sprinkle missing prefix refcounting
    
    When we drop the prefix lock to call nd6_prefix_offlink() or
    nd6_prefix_onlink(), make sure to keep the correpsonding prefix
    structure alive.  It is possible for a concurrent nd6_timer() to expire
    the prefix while the lock is dropped.
    
    Reported by:    Maik Muench of Secfault Security
    Reviewed by:    pouria, zlei
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58423
---
 sys/netinet6/nd6_rtr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c
index 167f3704f02d..041fd25865ab 100644
--- a/sys/netinet6/nd6_rtr.c
+++ b/sys/netinet6/nd6_rtr.c
@@ -1940,6 +1940,7 @@ restart:
 		flags = pr->ndpr_stateflags & (NDPRF_DETACHED | NDPRF_ONLINK);
 		if (flags == 0 || flags == (NDPRF_DETACHED | NDPRF_ONLINK)) {
 			genid = V_nd6_list_genid;
+			nd6_prefix_ref(pr);
 			ND6_RUNLOCK();
 			if ((flags & NDPRF_ONLINK) != 0 &&
 			    (e = nd6_prefix_offlink(pr)) != 0) {
@@ -1958,6 +1959,7 @@ restart:
 					    &pr->ndpr_prefix.sin6_addr),
 					    pr->ndpr_plen, e));
 			}
+			nd6_prefix_rele(pr);
 			ND6_RLOCK();
 			if (genid != V_nd6_list_genid)
 				goto restart;
@@ -2220,6 +2222,7 @@ restart:
 				int e;
 
 				genid = V_nd6_list_genid;
+				nd6_prefix_ref(opr);
 				ND6_RUNLOCK();
 				if ((e = nd6_prefix_onlink(opr)) != 0) {
 					nd6log((LOG_ERR,
@@ -2231,6 +2234,7 @@ restart:
 					    if_name(opr->ndpr_ifp), e));
 				} else
 					a_failure = 0;
+				nd6_prefix_rele(opr);
 				ND6_RLOCK();
 				if (genid != V_nd6_list_genid)
 					goto restart;