From nobody Tue Jul 28 20:36:59 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h8nM4547wz6nFgj for ; Tue, 28 Jul 2026 20:37:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h8nM44GPSz3JQt for ; Tue, 28 Jul 2026 20:37:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785271024; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=g2pYDANCVaxMSEOp91TMYePZk0GR3FgSuK7xp9jakho=; b=GfD7yny0SUEARAxUasx3+6GGMGwmhjtcgIQAQCWV5LckULRXJDp6OyrBjsw4v8kyP2ZK02 +l/5p6Qtdx9xZk+TVDKfOG8at/9t0y8thBSv+tabBTsh9sCvZYyk/F8JDH9QfHfMUSrly0 ID3ueJia8pu7LB8HYvOP0CCETAPQlWsliLD8by1EQyXrL8b8m5GA/P+eECOrkfXr8z/Jsa MDWJQe6/jhnk98vMAcpGuRoj1dGF53h/EeJ8st8x7T4TLa/2ZMpgt5+A/gsbluiXbLCYyx PUGoT2XXl0qSo5pg1KUvliiddjFLq4crviNAc9QhGm5kdhWfGR7Oc0PO6Cgl3A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785271024; a=rsa-sha256; cv=none; b=fBcMyVBqOoSiewhhdQv1YTy0Nqh6X8jas7umtZgvzhNSGJythpOUZpmXSGDvuC9JYyefDG PDP3ZOpOkaSGRxFxCy/C9SjtjjSKM0ayDtXqN9p7xt5RKrk2QKoObJnm3NLGUTs3CkIup8 eFrOd3GGSsX9YTScdRC3Z8DdXpRqtyadtOSDJ5VYuglUd4lBZNs65TuftZmnuUN6t0GJmR n28uITP7L0/hZkux6WdAwQ/mgIuTzaFZD5fiwO1WYqzb8CS2bVRHa4uA+sgXTA/jOI4Xvy OVjH+78DxX7w/QORHFJskHExsvfOEzWz01yFWcTrMcKMpD6HEizv/RzfxaHx1A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785271024; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=g2pYDANCVaxMSEOp91TMYePZk0GR3FgSuK7xp9jakho=; b=d7DWOH+arZT+7FhuBo6X1KJ7Mv8curnhxOmJx97Nw0J94FTEvkM+AiYTkkrEwq957A1gOc 23u2EkxShxaFS/triflKz4Uv/vYajdnEPEuMVUdRCylK4xNAy6aeP6Pvl7/BFjWwytrnf2 GBolFp4M0d81lVL1N9AIfHmkprerRtYHvy6WExDphDen/TTLwAf5jpZKXrude8h/EihpfQ YL+pNzpBqLp+l9qIJ0Qk0caslS424AA6zTGflxeMEmGwOmCy3rFf8hF4ZLkhURZpaEzbmT +gt7wlmbDT00NqKUljxnV3UlGHnBm4MXehw5QDHbtuHB+2ALqfn/KB0bTCB11Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h8nM43HxczvcQ for ; Tue, 28 Jul 2026 20:37:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1966d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 28 Jul 2026 20:36:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: =?utf-8?Q?Vin=C3=ADci?=us Fe=?utf-8?Q?rr=C3=A3o?= From: Pouria Mousavizadeh Tehrani Subject: git: 053d95ec2afe - main - nd6: Set ip6 after m_pullup() in nd6_ra_input() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: pouria X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 053d95ec2afe063e73fc8460584e7fd2a408f839 Auto-Submitted: auto-generated Date: Tue, 28 Jul 2026 20:36:59 +0000 Message-Id: <6a6912eb.1966d.580e4318@gitrepo.freebsd.org> The branch main has been updated by pouria: URL: https://cgit.FreeBSD.org/src/commit/?id=053d95ec2afe063e73fc8460584e7fd2a408f839 commit 053d95ec2afe063e73fc8460584e7fd2a408f839 Author: Vinícius Ferrão AuthorDate: 2026-07-28 20:04:41 +0000 Commit: Pouria Mousavizadeh Tehrani CommitDate: 2026-07-28 20:35:42 +0000 nd6: Set ip6 after m_pullup() in nd6_ra_input() nd6_ra_input() reads the IPv6 header pointer ip6 before m_pullup(), then uses that pointer afterwards to set nd_ra. When m_pullup() relocates the chain it frees the original first mbuf and returns a new one, leaving ip6 dangling; the subsequent access may be a use-after-free read. The fix writes ip6 from the returned mbuf after m_pullup() inside the conditional if. Reviewed by: pouria Differential Revision: https://reviews.freebsd.org/D58229 --- sys/netinet6/nd6_rtr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c index 041fd25865ab..4004a23308d1 100644 --- a/sys/netinet6/nd6_rtr.c +++ b/sys/netinet6/nd6_rtr.c @@ -556,6 +556,7 @@ nd6_ra_input(struct mbuf *m, int off, int icmp6len) IP6STAT_INC(ip6s_exthdrtoolong); return; } + ip6 = mtod(m, struct ip6_hdr *); } nd_ra = (struct nd_router_advert *)((caddr_t)ip6 + off);