CVS commit: src/sys/netinet6

["Taylor R Campbell" <riastradh%netbsd.org@localhost>]

Module Name:    src
Committed By:   riastradh
Date:           Thu Jul 23 20:25:49 UTC 2026

Modified Files:
        src/sys/netinet6: nd6_nbr.c

Log Message:
nd6: Redo previous avoidance of buffer overread.

Previous change invalidated two checks of the length:

    285         if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
    286                 nd6log(LOG_INFO, "lladdrlen mismatch for %s "
    287                     "(if %d, NS packet %d)\n",
    288                     IN6_PRINT(ip6buf, &taddr6),
    289                     ifp->if_addrlen, lladdrlen - 2);
    290                 goto bad;
    291         }

https://nxr.netbsd.org/xref/src/sys/netinet6/nd6_nbr.c?r=1.186#285

    685                 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
    686                         nd6log(LOG_INFO, "lladdrlen mismatch for %s "
    687                             "(if %d, NA packet %d)\n",
    688                             IN6_PRINT(ip6buf, &taddr6),
    689                             ifp->if_addrlen, lladdrlen - 2);
    690                         goto bad;
    691                 }

https://nxr.netbsd.org/xref/src/sys/netinet6/nd6_nbr.c?r=1.186#685

Even if we readjust it for the checks, it's still basically wrong:
the buffer may have extra padding in there to round it up to a
multiple of eight bytes, so we have to know what the correct length
is for the interface anyway.  And we do: it's ifp->if_addrlen.  So
just use that, after verifying the option has enough space for an
address of that length.

To make sure there are no accidental references to the option length
(including header) lying around, I've renamed the variable lladdrlen
to lladdroptlen.

PR kern/60488: nd6: two-byte buffer overread in source/target
linkaddr options


To generate a diff of this commit:
cvs rdiff -u -r1.187 -r1.188 src/sys/netinet6/nd6_nbr.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.