From nobody Mon Oct 05 13:21:09 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hz0QF55BMz4nGxv for ; Mon, 05 Oct 2026 13:21:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hz0QF3SH2z4ng2 for ; Mon, 05 Oct 2026 13:21:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791206469; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bp5yuHxB35Tttc0BVVP65zzYW+wVVm5ves60R0AYJO8=; b=vMeLKqNAMuanaKraB1aY63+rcZ0isZzSEgjRbmIgnYxzVVI1uU92XhMSaimpJTOaekt01w LSHShC2ZzjatKyFECkcI0KfrtvVpHeXqejvTkzfImXuqZtildn3LNm1nsqNb8pVu4DBjWi Ep9UdFZAklrnQwUc36sYA8sESiboYzm2Y5kX6aV5TAcY2NlokrPsrUG/CowqIb7myQucoa KNa3NYYhOGLmSYTVUi2b3I6+6p53AYmVqfSBn4tMgtlvj0lFF8KzFcWjZnqKcIn4FQknse kVF0tIDiChThTfvZQFpKs1g20I/vSaT8xjdYA41WUNktD0YLsVljBgAOCHOxNQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791206469; b=yXdCTA3fTNspyBVIk1Affq/uRejXGy6isthiCn1S/xVQsyIFlz3vgEw6t3tXTXxbA0lk6q DL/oM1NZD4BqO/L7/6BKAxdaLItMMC1nWsF5Fp1liltA2yhQ2RkXtLCSeK0JccZW0NgRoX 3+NB8xctNlky1itmb18yv0oeml6CcX4ArFwtpsqtno5zW016HtABDgPb6GqO04PcSOAM0x 68QhnWy3kfVFqW7EBoCZz6/6g/S6b4svi7R5GGdGkIeeYeRVksDx3fEaXsxZGetZCq3vD2 onoElU7hwP1Fq1VHOb4aUFZ1XufvwglzZT1ocpH8NX7daCtZbXc/RTtKMeLz7g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791206469; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bp5yuHxB35Tttc0BVVP65zzYW+wVVm5ves60R0AYJO8=; b=aPlbJwGc4fWKFQ0myXqdRUrRyRqRrxW1YqHVAhb7p7wLUGQQFh6GyARds1k9e/SmG0krXT nu1obBzEtlx+A5cr2E0m5XOHqjwShI8zrnxNxsxlGFUlmQbcPzVIHBGzspGQr/md3a3lik L/jtD/fvHskxKHoPG3r69fjIefKWS/0ZbmyKHSfuFe2yS7H1PLE7H5Z/HREz+RnUlvdsyt Edw9sBepFwo6dQK/hhzvV0Zh1bWI6c/ZkrjJ2CVtK9SdOxqCqM+0DzS2A61xyNaaNzGy6Q oWDAAyna/hNQxFckGTAQWQEkAx4r7eLuGNhbC+F/rUalZiBaLVvJRJs2aS3c+w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hz0QF2S2KzL7W for ; Mon, 05 Oct 2026 13:21:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 40859 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 05 Oct 2026 13:21:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: c109a681456d - main - netinet6: Fix the OSIOCAIFADDR_IN6 handler List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c109a681456d03fc0737ca83487995e28b759e3b Auto-Submitted: auto-generated Date: Mon, 05 Oct 2026 13:21:09 +0000 Message-Id: <6ac3a445.40859.16ead508@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c109a681456d03fc0737ca83487995e28b759e3b commit c109a681456d03fc0737ca83487995e28b759e3b Author: Mark Johnston AuthorDate: 2026-10-05 13:13:47 +0000 Commit: Mark Johnston CommitDate: 2026-10-05 13:20:58 +0000 netinet6: Fix the OSIOCAIFADDR_IN6 handler We cannot simply treat a pointer to struct oin6_aliasreq as a pointer to struct in6_aliasreq: the latter is larger. In particular, the store to ifra->ifra_vhid is out of bounds. Since OSIOCAIFADDR_IN6 does not need to copy data back out, it can simply use a struct in6_ifaliasreq on the stack. Reported by: Andrew Reviewed by: pouria MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D60184 --- sys/netinet6/in6.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c index 2c4dd09a28db..aa0528552163 100644 --- a/sys/netinet6/in6.c +++ b/sys/netinet6/in6.c @@ -266,7 +266,7 @@ in6_control_ioctl(u_long cmd, void *data, { struct in6_ifreq *ifr = (struct in6_ifreq *)data; struct in6_ifaddr *ia = NULL; - struct in6_aliasreq *ifra = (struct in6_aliasreq *)data; + struct in6_aliasreq tmpifra, *ifra = (struct in6_aliasreq *)data; struct sockaddr_in6 *sa6; int error; bool control_locked = false; @@ -276,7 +276,9 @@ in6_control_ioctl(u_long cmd, void *data, */ if (cmd == OSIOCAIFADDR_IN6) { cmd = SIOCAIFADDR_IN6; - ifra->ifra_vhid = 0; + ifra = &tmpifra; + memset(ifra, 0, sizeof(*ifra)); + memcpy(ifra, data, sizeof(struct oin6_aliasreq)); } switch (cmd) {