git: 053d95ec2afe - main - nd6: Set ip6 after m_pullup() in nd6_ra_input()

The branch main has been updated by pouria:

URL: https://cgit.FreeBSD.org/src/commit/?id=053d95ec2afe063e73fc8460584e7fd2a408f839

commit 053d95ec2afe063e73fc8460584e7fd2a408f839
Author:     Vinícius Ferrão <vinicius@ferrao.net.br>
AuthorDate: 2026-07-28 20:04:41 +0000
Commit:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
CommitDate: 2026-07-28 20:35:42 +0000

    nd6: Set ip6 after m_pullup() in nd6_ra_input()
    
    nd6_ra_input() reads the IPv6 header pointer ip6 before m_pullup(), then
    uses that pointer afterwards to set nd_ra.
    
    When m_pullup() relocates the chain it frees the original first mbuf and
    returns a new one, leaving ip6 dangling; the subsequent access may be a
    use-after-free read.
    
    The fix writes ip6 from the returned mbuf after m_pullup() inside the
    conditional if.
    
    Reviewed by: pouria
    Differential Revision: https://reviews.freebsd.org/D58229
---
 sys/netinet6/nd6_rtr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c
index 041fd25865ab..4004a23308d1 100644
--- a/sys/netinet6/nd6_rtr.c
+++ b/sys/netinet6/nd6_rtr.c
@@ -556,6 +556,7 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len)
 			IP6STAT_INC(ip6s_exthdrtoolong);
 			return;
 		}
+		ip6 = mtod(m, struct ip6_hdr *);
 	}
 	nd_ra = (struct nd_router_advert *)((caddr_t)ip6 + off);