git: c109a681456d - main - netinet6: Fix the OSIOCAIFADDR_IN6 handler

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=c109a681456d03fc0737ca83487995e28b759e3b

commit c109a681456d03fc0737ca83487995e28b759e3b
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-10-05 13:13:47 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-05 13:20:58 +0000

    netinet6: Fix the OSIOCAIFADDR_IN6 handler
    
    We cannot simply treat a pointer to struct oin6_aliasreq as a pointer to
    struct in6_aliasreq: the latter is larger.  In particular, the store to
    ifra->ifra_vhid is out of bounds.
    
    Since OSIOCAIFADDR_IN6 does not need to copy data back out, it can
    simply use a struct in6_ifaliasreq on the stack.
    
    Reported by:    Andrew <xxx.sys@protonmail.com>
    Reviewed by:    pouria
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D60184
---
 sys/netinet6/in6.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c
index 2c4dd09a28db..aa0528552163 100644
--- a/sys/netinet6/in6.c
+++ b/sys/netinet6/in6.c
@@ -266,7 +266,7 @@ in6_control_ioctl(u_long cmd, void *data,
 {
 	struct	in6_ifreq *ifr = (struct in6_ifreq *)data;
 	struct	in6_ifaddr *ia = NULL;
-	struct	in6_aliasreq *ifra = (struct in6_aliasreq *)data;
+	struct in6_aliasreq tmpifra, *ifra = (struct in6_aliasreq *)data;
 	struct sockaddr_in6 *sa6;
 	int error;
 	bool control_locked = false;
@@ -276,7 +276,9 @@ in6_control_ioctl(u_long cmd, void *data,
 	 */
 	if (cmd == OSIOCAIFADDR_IN6) {
 		cmd = SIOCAIFADDR_IN6;
-		ifra->ifra_vhid = 0;
+		ifra = &tmpifra;
+		memset(ifra, 0, sizeof(*ifra));
+		memcpy(ifra, data, sizeof(struct oin6_aliasreq));
 	}
 
 	switch (cmd) {