The DHCPv6 client hangs when a received IA_NA / IA_TA option contains an encapsulated sub-option of length zero: dhcp6_parse_ia_options() advances its cursor by the sub-option length alone, so a zero length never makes progress and the client spins forever. A host on the local link able to answer the client's SOLICIT during a netboot can trigger this; the IA_ID it has to match is observable in the SOLICIT.
Patch 1 fixes the advance so every iteration moves past a whole sub-option. Patch 2 adds a sandbox DM regression test that injects such an ADVERTISE and checks the client parses past it and re-solicits. The same parser also reads a fixed 16 bytes for an IAADDR sub-option (and a u16 for STATUS_CODE) without a length check. Those reads stay within the received-packet buffer and only reflect packet bytes back as the client's own address, so they are not addressed here; I can send a follow-up that bounds them if preferred. A reproducer is available on request. Signed-off-by: Shahriyar Jalayeri <[email protected]> --- Shahriyar Jalayeri (2): net: dhcp6: prevent an infinite loop parsing IA options test: dm: eth: add a DHCPv6 zero-length IA option test net/dhcpv6.c | 3 +- test/dm/eth.c | 120 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 122 insertions(+), 1 deletion(-) --- base-commit: baa64b2f892890f00a377eac4a3e685472bb56b5 change-id: 20260807-poc-dhcp6-ia-loop-935bc1a7d792 Best regards, -- Shahriyar Jalayeri <[email protected]>
