NetBSD Problem Report #60491

From www@netbsd.org  Thu Jul 23 20:56:59 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 8801F1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 23 Jul 2026 20:56:59 +0000 (UTC)
Message-Id: <20260723205658.48EC51A923C@mollari.NetBSD.org>
Date: Thu, 23 Jul 2026 20:56:58 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: arp creates state for invalid messages
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60491
>Category:       kern
>Synopsis:       arp creates state for invalid messages
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 23 21:00:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Thu Jul 23 22:10:04 +0000 2026
>Originator:     Taylor R Campbell
>Release:        
>Organization:
The NetBSD Addressolution, Invalid
>Environment:
>Description:

	The arp input path doesn't validate the op until after it has
	allocated memory and stored state for the message, causing the
	kernel to waste memory and report invalid arp entries to the
	system.

	Forwarded to us by Chris Jarrett-Davies <chrisjd@openai.com>.

>How-To-Repeat:

	send arp packets with bogus op fields

>Fix:

	validate earlier on in arpintr or ip_arpinput

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60491 CVS commit: src/sys/netinet
Date: Thu, 23 Jul 2026 21:49:19 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Thu Jul 23 21:49:19 UTC 2026

 Modified Files:
 	src/sys/netinet: if_arp.c

 Log Message:
 arp: Validate op on input, before creating any state.

 PR kern/60491: arp creates state for invalid messages


 To generate a diff of this commit:
 cvs rdiff -u -r1.320 -r1.321 src/sys/netinet/if_arp.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Thu, 23 Jul 2026 22:10:04 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10, pullup-9


>Unformatted:

Home	PR Database Search