PR/51467 CVS commit: src/sys/netinet6

["Ryota Ozaki" <ozaki-r%netbsd.org@localhost>]

The following reply was made to PR kern/51467; it has been noted by GNATS.

From: "Ryota Ozaki" <ozaki-r%netbsd.org@localhost>
To: gnats-bugs%gnats.NetBSD.org@localhost
Cc: 
Subject: PR/51467 CVS commit: src/sys/netinet6
Date: Wed, 30 Nov 2016 02:08:57 +0000

 Module Name:	src
 Committed By:	ozaki-r
 Date:		Wed Nov 30 02:08:57 UTC 2016
 
 Modified Files:
 	src/sys/netinet6: in6_ifattach.c
 
 Log Message:
 Fix panic on destroying an interface with IPv6 addresses obtained with RA
 
 nd6_purge depends on that IPv6 addresses are purged. If addresses remain,
 pfxlist_onlink_check called from nd6_purge dereferences a dangling pointer
 (ia->ia6_ndpr) that is freed before calling pfxlist_onlink_check. Fix it by
 removing addresses before calling nd6_purge, which is the original behavior
 that was changed by in6.c,v 1.203 and in6_ifattach.c,v 1.99.
 
 Note that it seems the issue occurs because of a hack that forcibly destroys
 prefix list entries of a given interface in nd6_purge. We should tackle the
 hack in the future.
 
 Fix PR kern/51467
 
 
 To generate a diff of this commit:
 cvs rdiff -u -r1.106 -r1.107 src/sys/netinet6/in6_ifattach.c
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.