git: 1d7b05142254 - main - netinet6: Handle unspecified foreign addresses in in6_pcbconnect()

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=1d7b0514225479ecbed8c4bc2258ce0356d20bc1

commit 1d7b0514225479ecbed8c4bc2258ce0356d20bc1
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-29 13:14:21 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-07-29 13:14:21 +0000

    netinet6: Handle unspecified foreign addresses in in6_pcbconnect()
    
    Prior to commit 90ea8e89d9b751e8b5ae90ef3397883b035788e5, this was
    handled by calling in6_pcbladdr().
    
    Reported by:    syzkaller
    Reviewed by:    pouria, glebius
    Fixes:          90ea8e89d9b7 ("netinet6: refactor in6_pcbconnect()")
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58518
---
 sys/netinet6/in6_pcb.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sys/netinet6/in6_pcb.c b/sys/netinet6/in6_pcb.c
index 3af4c0a14468..ee11e535c227 100644
--- a/sys/netinet6/in6_pcb.c
+++ b/sys/netinet6/in6_pcb.c
@@ -396,10 +396,6 @@ in6_pcbladdr(struct inpcb *inp, struct sockaddr_in6 *sin6,
 	if ((error = sa6_embedscope(sin6, V_ip6_use_defzone)) != 0)
 		return(error);
 
-	/* RFC4291 section 2.5.2 */
-	if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
-		return (ENETUNREACH);
-
 	if ((error = prison_remote_ip6(inp->inp_cred, &sin6->sin6_addr)) != 0)
 		return (error);
 
@@ -465,6 +461,10 @@ in6_pcbconnect(struct inpcb *inp, struct sockaddr_in6 *sin6, struct ucred *cred,
 	KASSERT(IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr),
 	    ("%s: inp is already connected", __func__));
 
+	/* RFC4291 section 2.5.2 */
+	if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
+		return (ENETUNREACH);
+
 	anonport = (inp->inp_lport == 0);
 
 	INP_HASH_WLOCK(pcbinfo);