From nobody Fri Mar 13 11:41:31 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fXMyS35nMz6VxgY for ; Fri, 13 Mar 2026 11:41:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fXMyS2Q3vz3LP9 for ; Fri, 13 Mar 2026 11:41:36 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1773402096; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=T3zu2Rq2Obb7FOXh7ZJuphDKbbPrJlw2esxqU0zjCYo=; b=F4vpDkFftKCUm6yESyK/WLiqozdX3/mvsfTTDZoqCtRiGAQsBr+6e+YJQPhbHX1p+g5dJq JqhhmZMiLyGDONpBhvJMkPus1/7bzytpPnQ7UctgHK+5VfPdsKTRRHj5z04TCBYoQTJxXU hbUs1M9vVtB1DxQF99O8R3bGrzeohOcotJYqRB8HtV/YBYaEm+fTDShNrPO+W75eK1YoEb +kv9FPXW2RlmsoOLXehN7mgji3tDYN3+xr5ufwuRs7EgA3uRltCxZbFcutCAXIHuMlHWXP KeNIE5ZT/jcMKuGDEgeRXQxsrtUaPtwVSi+bLZ1/+r54reAlmt5wjKJooXRpkg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1773402096; a=rsa-sha256; cv=none; b=WrLmJcBUg2KvOhY1yaJXdX3iBdDCenbaCsmhb0EAB8rYsHBMvo2mV5AMOlheahX5cweYVD lZXXEa0KE90MHvuWHQs9Gx1Ez8WImPG3Sm+dKEyYfzN6iBmvmHRvBIaT7VW5Wef61HCqKx qLul6jussmxmDnOHlfNVYm6vt0++v9kbEhFBwJeN3eAdI+wl8Q6zJgDwFzgWefUgTVSo+y IGB8xi1+AiO4cGBEpiJJipGOltnaTI9FS6/Z5SvZgiFD7KIqKAl7VTulNo9ylx4hRiYqNU iJKJMd5VeyhmEtdjn7rbMQ0zW7A10coU7YPr7eh8pV/OPc6bcxS5dcjdzWN/Qg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1773402096; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=T3zu2Rq2Obb7FOXh7ZJuphDKbbPrJlw2esxqU0zjCYo=; b=gSHlIYetyHSjdluPAkGAdohleRyH12xEnrwRvaNT2dkx8tlhcBLCKuLU+DbaAK9bMlIwKg ndQVwcLXYgMTnXTn+5XHBmRNeJsyXHLZTpsZLNQc3f9OAhBEqOTqPdfWs2ymHY9eeybXP1 nhO4n8eM0/MsvzWFaR4ftNkK3nDPvAa6UEjUvSglqpEBo+2GYwkOP6Lzv4cTs4kzLgG157 Y8xrpFRk+8OKqN8FDU7+llQjQK3w5XE4MisoQfwtTxwC1CanC2PP+7zt00ErmJIU4IoW1C Eqy7AS0nxvfDR0LnrRRcAazcVT0lX7DLHrdWVOkJG6LrpOVePWMveiSLEaHgAQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4fXMyS1yLHzVTW for ; Fri, 13 Mar 2026 11:41:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1e0a8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 13 Mar 2026 11:41:31 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Pouria Mousavizadeh Tehrani Subject: git: 75f1665f3346 - main - ndp: Fix free after use and exclude delayed proxy List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: pouria X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 75f1665f33463e9ee0aaa63af0a875e6c46f8755 Auto-Submitted: auto-generated Date: Fri, 13 Mar 2026 11:41:31 +0000 Message-Id: <69b3f7eb.1e0a8.4bd61a06@gitrepo.freebsd.org> The branch main has been updated by pouria: URL: https://cgit.FreeBSD.org/src/commit/?id=75f1665f33463e9ee0aaa63af0a875e6c46f8755 commit 75f1665f33463e9ee0aaa63af0a875e6c46f8755 Author: Pouria Mousavizadeh Tehrani AuthorDate: 2026-03-13 11:36:04 +0000 Commit: Pouria Mousavizadeh Tehrani CommitDate: 2026-03-13 11:36:04 +0000 ndp: Fix free after use and exclude delayed proxy PR: 293777 Fixes: f37fbe30f559 ("ndp: implement delayed ...") --- sys/netinet6/nd6_nbr.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/sys/netinet6/nd6_nbr.c b/sys/netinet6/nd6_nbr.c index 0a34e0e3628e..25786ebc0ea1 100644 --- a/sys/netinet6/nd6_nbr.c +++ b/sys/netinet6/nd6_nbr.c @@ -361,7 +361,7 @@ nd6_ns_input(struct mbuf *m, int off, int icmp6len) * be delayed by a random time between 0 and MAX_ANYCAST_DELAY_TIME * to reduce the probability of network congestion. */ - if (anycast == 0 && proxy == 0) + if (anycast == 0) nd6_na_output_fib(ifp, &saddr6, &taddr6, rflag, tlladdr, proxy ? (struct sockaddr *)&proxydl : NULL, M_GETFIB(m)); else @@ -1652,16 +1652,16 @@ static void nd6_queue_rel(void *arg) { struct nd_queue *ndq = arg; - struct ifnet *ifp = ndq->ndq_ifa->ifa_ifp; - - IF_ADDR_WLOCK_ASSERT(ifp); + struct ifaddr *ifa = ndq->ndq_ifa; - /* Remove ndq from the nd_queue and release its reference */ - TAILQ_REMOVE(&ifp->if_inet6->nd_queue, ndq, ndq_list); - IF_ADDR_WUNLOCK(ifp); + IF_ADDR_WLOCK_ASSERT(ifa->ifa_ifp); - ifa_free(ndq->ndq_ifa); + /* Remove ndq from the nd_queue and free it */ + TAILQ_REMOVE(&ifa->ifa_ifp->if_inet6->nd_queue, ndq, ndq_list); free(ndq, M_IP6NDP); + IF_ADDR_WUNLOCK(ifa->ifa_ifp); + + ifa_free(ifa); } static void @@ -1671,6 +1671,7 @@ nd6_queue_timer(void *arg) struct ifaddr *ifa = ndq->ndq_ifa; struct ifnet *ifp = ifa->ifa_ifp; struct in6_ifextra *ext = ifp->if_inet6; + struct in6_addr daddr; struct epoch_tracker et; int delay, tlladdr; u_long flags; @@ -1680,6 +1681,7 @@ nd6_queue_timer(void *arg) CURVNET_SET(ifp->if_vnet); NET_EPOCH_ENTER(et); + daddr = ndq->ndq_daddr; tlladdr = ND6_NA_OPT_LLA; flags = (V_ip6_forwarding) ? ND_NA_FLAG_ROUTER : 0; if ((ext->nd_flags & ND6_IFF_ACCEPT_RTADV) != 0 && V_ip6_norbit_raif) @@ -1713,8 +1715,8 @@ nd6_queue_timer(void *arg) callout_reset(&ndq->ndq_callout, delay, nd6_queue_rel, ndq); IF_ADDR_WUNLOCK(ifp); - if (__predict_true(in6_setscope(&ndq->ndq_daddr, ifp, NULL) == 0)) - nd6_na_output_fib(ifp, &ndq->ndq_daddr, IFA_IN6(ifa), flags, tlladdr, + if (__predict_true(in6_setscope(&daddr, ifp, NULL) == 0)) + nd6_na_output_fib(ifp, &daddr, IFA_IN6(ifa), flags, tlladdr, NULL, ifp->if_fib); NET_EPOCH_EXIT(et);