diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-07-29 13:14:21 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-07-29 13:14:21 +0000 |
| commit | 1d7b0514225479ecbed8c4bc2258ce0356d20bc1 (patch) | |
| tree | 92a83673eb563fd291936bdc3fa59ddb81c0310f | |
| parent | 9a9349ea1da2d80e979fa87b430551d8f6dac7f4 (diff) | |
netinet6: Handle unspecified foreign addresses in in6_pcbconnect()
Prior to commit 90ea8e89d9b751e8b5ae90ef3397883b035788e5, this was
handled by calling in6_pcbladdr().
Reported by: syzkaller
Reviewed by: pouria, glebius
Fixes: 90ea8e89d9b7 ("netinet6: refactor in6_pcbconnect()")
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58518
| -rw-r--r-- | sys/netinet6/in6_pcb.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/netinet6/in6_pcb.c b/sys/netinet6/in6_pcb.c index 3af4c0a14468..ee11e535c227 100644 --- a/sys/netinet6/in6_pcb.c +++ b/sys/netinet6/in6_pcb.c @@ -396,10 +396,6 @@ in6_pcbladdr(struct inpcb *inp, struct sockaddr_in6 *sin6, if ((error = sa6_embedscope(sin6, V_ip6_use_defzone)) != 0) return(error); - /* RFC4291 section 2.5.2 */ - if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) - return (ENETUNREACH); - if ((error = prison_remote_ip6(inp->inp_cred, &sin6->sin6_addr)) != 0) return (error); @@ -465,6 +461,10 @@ in6_pcbconnect(struct inpcb *inp, struct sockaddr_in6 *sin6, struct ucred *cred, KASSERT(IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr), ("%s: inp is already connected", __func__)); + /* RFC4291 section 2.5.2 */ + if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) + return (ENETUNREACH); + anonport = (inp->inp_lport == 0); INP_HASH_WLOCK(pcbinfo); |