git: f318186deb3e - stable/13 - netlink: Fully clear parser state between messages

[Dag-Erling Smørgrav]

The branch stable/13 has been updated by des:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=f318186deb3ef3b90104e8372563e80c9358183e

commit f318186deb3ef3b90104e8372563e80c9358183e
Author:     Dag-Erling Smørgrav <d...@freebsd.org>
AuthorDate: 2025-07-31 10:06:47 +0000
Commit:     Dag-Erling Smørgrav <d...@freebsd.org>
CommitDate: 2025-08-06 13:52:14 +0000

    netlink: Fully clear parser state between messages
    
    Failing to reset the cookie between messages can lead to an attempt
    to interpret a zeroed buffer as a struct nlattr, causing a length
    calculation to underflow, resulting in a memcpy() call where the
    length exceeds the actual size of the buffer.
    
    MFC after:      1 week
    PR:             283797
    Reviewed by:    glebius
    Differential Revision:  https://reviews.freebsd.org/D51634
    
    (cherry picked from commit a8d90e32133b77a49c2551f22e59f72d65293b64)
---
 sys/netlink/netlink_io.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/netlink/netlink_io.c b/sys/netlink/netlink_io.c
index d33a3ace9e36..baa7e3350caf 100644
--- a/sys/netlink/netlink_io.c
+++ b/sys/netlink/netlink_io.c
@@ -454,6 +454,7 @@ static void
 npt_clear(struct nl_pstate *npt)
 {
        lb_clear(&npt->lb);
+       npt->cookie = NULL;
        npt->error = 0;
        npt->err_msg = NULL;
        npt->err_off = 0;