Date: Tue, 28 Jul 2026 20:36:59 +0000 From: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: =?utf-8?Q?Vin=C3=ADci?=us Fe=?utf-8?Q?rr=C3=A3o?= <vinicius@ferrao.net.br> Subject: git: 053d95ec2afe - main - nd6: Set ip6 after m_pullup() in nd6_ra_input() Message-ID: <6a6912eb.1966d.580e4318@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by pouria: URL: https://cgit.FreeBSD.org/src/commit/?id=053d95ec2afe063e73fc8460584e7fd2a408f839 commit 053d95ec2afe063e73fc8460584e7fd2a408f839 Author: Vinícius Ferrão <vinicius@ferrao.net.br> AuthorDate: 2026-07-28 20:04:41 +0000 Commit: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> CommitDate: 2026-07-28 20:35:42 +0000 nd6: Set ip6 after m_pullup() in nd6_ra_input() nd6_ra_input() reads the IPv6 header pointer ip6 before m_pullup(), then uses that pointer afterwards to set nd_ra. When m_pullup() relocates the chain it frees the original first mbuf and returns a new one, leaving ip6 dangling; the subsequent access may be a use-after-free read. The fix writes ip6 from the returned mbuf after m_pullup() inside the conditional if. Reviewed by: pouria Differential Revision: https://reviews.freebsd.org/D58229 --- sys/netinet6/nd6_rtr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c index 041fd25865ab..4004a23308d1 100644 --- a/sys/netinet6/nd6_rtr.c +++ b/sys/netinet6/nd6_rtr.c @@ -556,6 +556,7 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len) IP6STAT_INC(ip6s_exthdrtoolong); return; } + ip6 = mtod(m, struct ip6_hdr *); } nd_ra = (struct nd_router_advert *)((caddr_t)ip6 + off);home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a6912eb.1966d.580e4318>