From nobody Thu Oct 08 23:56:55 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j16NR5fHHz6Z0Ln for ; Thu, 08 Oct 2026 23:56:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j16NR4vsSz4Hhk for ; Thu, 08 Oct 2026 23:56:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791503815; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1ezCn4BNzZZ/YCkuUYshx32CF28NB1a4ZRXvE3SFQg4=; b=NhMkdpRR0j9gw2W/RH03oDI9YoE3tYibsPaGDSDIyVK1vsr95b9BvPhohmoWDtAcAqQUI6 mO/NF5XK5B0l9s0GIMMfO40kmG75WlkfFQ2RpwkQCQWcUeiqHT83u7mEym9kCnf3mIPD+r X7+NMAMWXkAhFRIRjOcWRbpdqO8KVlD4KctfAlJMP74TRtuhoYmcxl7Wyo/FRPuErnAGDg D7ygKcOjA0Jij2Q+zV640SLnWC8vPGOMgf/pT8Rzu7lBhEHtL7nI4SvymktYue+wpGTajQ ldlSKy8MPWv6nMBodz1MYpblx4u8CW7XN//pbgkMle4FMyhvBaleDdmESmsTeQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791503815; b=AcjO1F9vWJZ8qf4Bq1R+q3gC+wwx2arIsd0Qp5rK0m1HgF3I4huNkwhp8l86lHye6SEZoW 7CwzNY+/YT3luibwYgu2SyxsJLiYmaHlB3OBeSO8Y0jDECRxA8+ZBRz6APfj7MTkLIDCyi Hefws2dWkO0jDCeDVu4bSqPa4dqoFZj8Za1UrtWNLkucps5VAddGaEqPImiITrAD7/UXA1 BsoLDZmO4OFszIPfMWIDp7OVrFU+Ys5Y/lmzivu3tOOGCbIvukPK7mB+GN6ljxTS0YHZW3 kYQGYPOCjDdYl7UBXwed0g/EHppiPvPC+51i88UV620h5nw03q8AiXVqg3XgAQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791503815; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1ezCn4BNzZZ/YCkuUYshx32CF28NB1a4ZRXvE3SFQg4=; b=gpRinoHs/Z6W+NLxdmrLhZwUBH7bljNbAuQGuPcBcBAcx/3CSfpRk1yvbRMnDxRrH2NE6A pi6NXIa7/ENWRhk6QbpftSVZ9DpZ3fVmVrIxSm1g85sEwUnxov9J1Q3v6DG9amyZWLhDRv jmkFHcR89XUseK8I13PnWRzBlj9YFGQx5G8CBrWQjzxcvxTRybSMR5n1uTqrnIbt1IGPqR Zo1QSGL0+JDEXi3BBcnC3BihVESAEFuzIa69b7PGccP0kPZIKJD3oVjdkxmsT03ABUP2FY qMawQMau8le2oDf/7ESiOU8MvqNJ+F2uscAAm9640UEbV0ImduP5rDPJ60IaHQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j16NR3znsz12Wy for ; Thu, 08 Oct 2026 23:56:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46f2d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 08 Oct 2026 23:56:55 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: R. Christian McDonald Subject: git: ec76d3f600b5 - main - nd6: Do not allocate an ifaddr for the interface ID in in6_ifadd() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ec76d3f600b528df7c29d3305e44342f08789fbf Auto-Submitted: auto-generated Date: Thu, 08 Oct 2026 23:56:55 +0000 Message-Id: <6ac82dc7.46f2d.35ee6d75@gitrepo.freebsd.org> The branch main has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=ec76d3f600b528df7c29d3305e44342f08789fbf commit ec76d3f600b528df7c29d3305e44342f08789fbf Author: R. Christian McDonald AuthorDate: 2026-10-08 23:08:19 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-08 23:08:19 +0000 nd6: Do not allocate an ifaddr for the interface ID in in6_ifadd() Without a suitable link-local address, in6_ifadd() obtains the interface identifier from in6_get_ifid(). It wrote the result into a freshly allocated struct in6_ifaddr, M_NOWAIT since the function runs in the network epoch, so SLAAC could fail under memory pressure over a 16 byte scratch buffer. Write the identifier into the on-stack address the rest of the function uses instead. Zero it first, in6_get_ifid() only fills in the low 64 bits, as the M_ZERO allocation did. Track which path provided the identifier with a flag instead of a pointer into the ifaddr, so each path releases its own reference. Reviewed by: glebius Fixes: 9e792f7ef729 ("sys/netinet6: Fix SLAAC for interfaces with no /64 LL address") Fixes: f9fc93690aef ("sys/netinet6: fix memory corruption in in6_ifadd") MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D60488 --- sys/netinet6/nd6_rtr.c | 50 +++++++++++++++++++++----------------------------- 1 file changed, 21 insertions(+), 29 deletions(-) diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c index 9d7cd3f832d9..ed31981ec9df 100644 --- a/sys/netinet6/nd6_rtr.c +++ b/sys/netinet6/nd6_rtr.c @@ -1215,7 +1215,7 @@ in6_ifadd(struct nd_prefixctl *pr, int mcast) struct in6_aliasreq ifra; struct in6_ifaddr *ia = NULL, *ib = NULL; int error, plen0; - struct in6_addr *ifid_addr = NULL, mask, newaddr; + struct in6_addr mask, newaddr; int prefixlen = pr->ndpr_plen; int updateflags; char ip6buf[INET6_ADDRSTRLEN]; @@ -1255,47 +1255,39 @@ in6_ifadd(struct nd_prefixctl *pr, int mcast) if(!in6_get_stableifid(ifp, &newaddr, prefixlen)) return NULL; } else { + bool have_ifid = false; + ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 0); /* 0 is OK? */ - if (ifa) { + if (ifa != NULL) { ib = (struct in6_ifaddr *)ifa; - ifid_addr = &ib->ia_addr.sin6_addr; /* prefixlen + ifidlen must be equal to 128 */ plen0 = in6_mask2len(&ib->ia_prefixmask.sin6_addr, NULL); - if (prefixlen != plen0) { - ifa_free(ifa); - ifid_addr = NULL; + if (prefixlen == plen0) { + memcpy(&newaddr, &ib->ia_addr.sin6_addr, + sizeof(newaddr)); + have_ifid = true; + } else { nd6log((LOG_DEBUG, "%s: wrong prefixlen for %s (prefix=%d ifid=%d)\n", __func__, if_name(ifp), prefixlen, 128 - plen0)); } + ifa_free(ifa); } - /* No suitable LL address, get the ifid directly */ - if (ifid_addr == NULL) { - ifa = ifa_alloc(sizeof(struct in6_ifaddr), M_NOWAIT); - if (ifa != NULL) { - ib = (struct in6_ifaddr *)ifa; - ifid_addr = &ib->ia_addr.sin6_addr; - if(in6_get_ifid(ifp, NULL, ifid_addr) != 0) { - nd6log((LOG_DEBUG, - "%s: failed to get ifid for %s\n", - __func__, if_name(ifp))); - ifa_free(ifa); - ifid_addr = NULL; - } + /* + * No suitable link-local address, get the ifid directly. + * Only the low 64 bits are filled in, zero the rest. + */ + if (!have_ifid) { + memset(&newaddr, 0, sizeof(newaddr)); + if (in6_get_ifid(ifp, NULL, &newaddr) != 0) { + nd6log((LOG_INFO, + "%s: could not determine ifid for %s\n", + __func__, if_name(ifp))); + return (NULL); } } - - if (ifid_addr == NULL) { - nd6log((LOG_INFO, - "%s: could not determine ifid for %s\n", - __func__, if_name(ifp))); - return NULL; - } - - memcpy(&newaddr, &ib->ia_addr.sin6_addr, sizeof(ib->ia_addr.sin6_addr)); - ifa_free(ifa); } IN6_MASK_ADDR(&ifra.ifra_addr.sin6_addr, &mask);