openbsd/src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2026-04-26 23:26:11 +00:00
Code Issues Projects Releases Wiki Activity

Ignore any iterator when traversing nd6 list.

Browse Source 
nd6_rtrequest() could crash with a NULL pointer dereference if an
interator in nd6_list was inspected.  Skip freeing neigbor discovery
entries and optimization in this unlikely case and try again later.

reported by Mischa and Anton Kasimov; OK mvs@
This commit is contained in:
bluhm
2025-11-27 21:54:28 +00:00
parent 49d7e2aa73
commit 8a75dc3b44
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
sys/netinet6/nd6.c
View File

@@ -1,4 +1,4 @@
/* $OpenBSD: nd6.c,v 1.304 2025/11/12 11:37:08 bluhm Exp $ */
/* $OpenBSD: nd6.c,v 1.305 2025/11/27 21:54:28 bluhm Exp $ */
/* $KAME: nd6.c,v 1.280 2002/06/08 19:52:07 itojun Exp $ */
/*
@@ -829,6 +829,9 @@ nd6_rtrequest(struct ifnet *ifp, int req, struct rtentry *rt)
ln_end = TAILQ_LAST(&nd6_list, llinfo_nd6_head);
if (ln_end == ln)
break;
/* cannot move the iterator, try next time */
if (ln_end->ln_rt == NULL)
break;
/* Move this entry to the head */
TAILQ_REMOVE(&nd6_list, ln_end, ln_list);