CVS commit: src/sys/netinet6

Module Name:	src
Committed By:	riastradh
Date:		Thu Jul 23 20:25:49 UTC 2026

Modified Files:
	src/sys/netinet6: nd6_nbr.c

Log Message:
nd6: Redo previous avoidance of buffer overread.

Previous change invalidated two checks of the length:

    285 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
    286 		nd6log(LOG_INFO, "lladdrlen mismatch for %s "
    287 		    "(if %d, NS packet %d)\n",
    288 		    IN6_PRINT(ip6buf, &taddr6),
    289 		    ifp->if_addrlen, lladdrlen - 2);
    290 		goto bad;
    291 	}

https://nxr.netbsd.org/xref/src/sys/netinet6/nd6_nbr.c?r=1.186#285

    685 		if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
    686 			nd6log(LOG_INFO, "lladdrlen mismatch for %s "
    687 			    "(if %d, NA packet %d)\n",
    688 			    IN6_PRINT(ip6buf, &taddr6),
    689 			    ifp->if_addrlen, lladdrlen - 2);
    690 			goto bad;
    691 		}

https://nxr.netbsd.org/xref/src/sys/netinet6/nd6_nbr.c?r=1.186#685

Even if we readjust it for the checks, it's still basically wrong:
the buffer may have extra padding in there to round it up to a
multiple of eight bytes, so we have to know what the correct length
is for the interface anyway.  And we do: it's ifp->if_addrlen.  So
just use that, after verifying the option has enough space for an
address of that length.

To make sure there are no accidental references to the option length
(including header) lying around, I've renamed the variable lladdrlen
to lladdroptlen.

PR kern/60488: nd6: two-byte buffer overread in source/target
linkaddr options


To generate a diff of this commit:
cvs rdiff -u -r1.187 -r1.188 src/sys/netinet6/nd6_nbr.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.