PR/60488 CVS commit: src/sys/netinet6

["Taylor R Campbell" <riastradh%netbsd.org@localhost>]

The following reply was made to PR kern/60488; it has been noted by GNATS.

From: "Taylor R Campbell" <riastradh%netbsd.org@localhost>
To: gnats-bugs%gnats.NetBSD.org@localhost
Cc: 
Subject: PR/60488 CVS commit: src/sys/netinet6
Date: Thu, 23 Jul 2026 20:25:49 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Thu Jul 23 20:25:49 UTC 2026
 
 Modified Files:
 	src/sys/netinet6: nd6_nbr.c
 
 Log Message:
 nd6: Redo previous avoidance of buffer overread.
 
 Previous change invalidated two checks of the length:
 
     285 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
     286 		nd6log(LOG_INFO, "lladdrlen mismatch for %s "
     287 		    "(if %d, NS packet %d)\n",
     288 		    IN6_PRINT(ip6buf, &taddr6),
     289 		    ifp->if_addrlen, lladdrlen - 2);
     290 		goto bad;
     291 	}
 
 https://nxr.netbsd.org/xref/src/sys/netinet6/nd6_nbr.c?r=1.186#285
 
     685 		if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
     686 			nd6log(LOG_INFO, "lladdrlen mismatch for %s "
     687 			    "(if %d, NA packet %d)\n",
     688 			    IN6_PRINT(ip6buf, &taddr6),
     689 			    ifp->if_addrlen, lladdrlen - 2);
     690 			goto bad;
     691 		}
 
 https://nxr.netbsd.org/xref/src/sys/netinet6/nd6_nbr.c?r=1.186#685
 
 Even if we readjust it for the checks, it's still basically wrong:
 the buffer may have extra padding in there to round it up to a
 multiple of eight bytes, so we have to know what the correct length
 is for the interface anyway.  And we do: it's ifp->if_addrlen.  So
 just use that, after verifying the option has enough space for an
 address of that length.
 
 To make sure there are no accidental references to the option length
 (including header) lying around, I've renamed the variable lladdrlen
 to lladdroptlen.
 
 PR kern/60488: nd6: two-byte buffer overread in source/target
 linkaddr options
 
 
 To generate a diff of this commit:
 cvs rdiff -u -r1.187 -r1.188 src/sys/netinet6/nd6_nbr.c
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.