[PATCH 0/2] net: dhcp6: fix an infinite loop parsing IA options

The DHCPv6 client hangs when a received IA_NA / IA_TA option contains an
encapsulated sub-option of length zero: dhcp6_parse_ia_options() advances
its cursor by the sub-option length alone, so a zero length never makes
progress and the client spins forever. A host on the local link able to
answer the client's SOLICIT during a netboot can trigger this; the IA_ID
it has to match is observable in the SOLICIT.

Patch 1 fixes the advance so every iteration moves past a whole
sub-option. Patch 2 adds a sandbox DM regression test that injects such an
ADVERTISE and checks the client parses past it and re-solicits.

The same parser also reads a fixed 16 bytes for an IAADDR sub-option (and
a u16 for STATUS_CODE) without a length check. Those reads stay within the
received-packet buffer and only reflect packet bytes back as the client's
own address, so they are not addressed here; I can send a follow-up that
bounds them if preferred.

A reproducer is available on request.

Signed-off-by: Shahriyar Jalayeri <[email protected]>
---
Shahriyar Jalayeri (2):
      net: dhcp6: prevent an infinite loop parsing IA options
      test: dm: eth: add a DHCPv6 zero-length IA option test

 net/dhcpv6.c  |   3 +-
 test/dm/eth.c | 120 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 122 insertions(+), 1 deletion(-)
---
base-commit: baa64b2f892890f00a377eac4a3e685472bb56b5
change-id: 20260807-poc-dhcp6-ia-loop-935bc1a7d792

Best regards,
--  
Shahriyar Jalayeri <[email protected]>