The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=1d7b0514225479ecbed8c4bc2258ce0356d20bc1
commit 1d7b0514225479ecbed8c4bc2258ce0356d20bc1 Author: Mark Johnston <[email protected]> AuthorDate: 2026-07-29 13:14:21 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2026-07-29 13:14:21 +0000 netinet6: Handle unspecified foreign addresses in in6_pcbconnect() Prior to commit 90ea8e89d9b751e8b5ae90ef3397883b035788e5, this was handled by calling in6_pcbladdr(). Reported by: syzkaller Reviewed by: pouria, glebius Fixes: 90ea8e89d9b7 ("netinet6: refactor in6_pcbconnect()") Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58518 --- sys/netinet6/in6_pcb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sys/netinet6/in6_pcb.c b/sys/netinet6/in6_pcb.c index 3af4c0a14468..ee11e535c227 100644 --- a/sys/netinet6/in6_pcb.c +++ b/sys/netinet6/in6_pcb.c @@ -396,10 +396,6 @@ in6_pcbladdr(struct inpcb *inp, struct sockaddr_in6 *sin6, if ((error = sa6_embedscope(sin6, V_ip6_use_defzone)) != 0) return(error); - /* RFC4291 section 2.5.2 */ - if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) - return (ENETUNREACH); - if ((error = prison_remote_ip6(inp->inp_cred, &sin6->sin6_addr)) != 0) return (error); @@ -465,6 +461,10 @@ in6_pcbconnect(struct inpcb *inp, struct sockaddr_in6 *sin6, struct ucred *cred, KASSERT(IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr), ("%s: inp is already connected", __func__)); + /* RFC4291 section 2.5.2 */ + if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) + return (ENETUNREACH); + anonport = (inp->inp_lport == 0); INP_HASH_WLOCK(pcbinfo);
