Bug 295995 - rtadvd segfault with -d
Summary: rtadvd segfault with -d
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 15.0-RELEASE
Hardware: Any Any
: --- Affects Only Me
Assignee: Pouria Mousavizadeh Tehrani
URL:
Keywords: crash, patch
Depends on:
Blocks:
 
Reported: 2026-06-11 11:06 UTC by Matt
Modified: 2026-08-05 15:23 UTC (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Matt 2026-06-11 11:06:24 UTC
rtadvd segfaults when run with the -d flag in my environment. It seems to be caused by sections like the following in rtadvd.c:

        /* O flag */
        if ((nra->nd_ra_flags_reserved & ND_RA_FLAG_OTHER) !=
            rai->rai_otherflg) {
                syslog(LOG_NOTICE,
                    "O flag inconsistent on %s:"
                    " %s from %s, %s from us",
                    ifi->ifi_ifname, on_off[!rai->rai_otherflg],
                    inet_ntop(AF_INET6, &from->sin6_addr, ntopbuf,
                        sizeof(ntopbuf)), on_off[rai->rai_otherflg]);
                inconsistent++;
        }

where rai->rai_otherflg in this case is 0x40 but handled as a bool. Here's a diff that fixes it for my case as well as other similarly-handled flags:

--- config.c.orig	2025-12-04 16:54:44.000000000 +0000
+++ config.c	2026-06-11 11:59:51.691932000 +0100
@@ -443,8 +443,8 @@
 	} else
 		MAYHAVE(val, "raflags", 0);
 
-	rai->rai_managedflg = val & ND_RA_FLAG_MANAGED;
-	rai->rai_otherflg = val & ND_RA_FLAG_OTHER;
+	rai->rai_managedflg = !!(val & ND_RA_FLAG_MANAGED);
+	rai->rai_otherflg = !!(val & ND_RA_FLAG_OTHER);
 #ifndef ND_RA_FLAG_RTPREF_MASK
 #define ND_RA_FLAG_RTPREF_MASK	0x18 /* 00011000 */
 #define ND_RA_FLAG_RTPREF_RSV	0x10 /* 00010000 */
@@ -456,7 +456,7 @@
 		goto getconfig_free_rai;
 	}
 #ifdef DRAFT_IETF_6MAN_IPV6ONLY_FLAG
-	rai->rai_ipv6onlyflg = val & ND_RA_FLAG_IPV6_ONLY;
+	rai->rai_ipv6onlyflg = !!(val & ND_RA_FLAG_IPV6_ONLY);
 #endif
 
 	MAYHAVE(val, "rltime", rai->rai_maxinterval * 3);
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2026-06-11 13:26:47 UTC
^Triage: note that this Problem Report contains an inline patch.
Comment 2 commit-hook freebsd_committer freebsd_triage 2026-08-05 15:22:12 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=200de1b70e2b4f809d1d3a4c430db80b24124468

commit 200de1b70e2b4f809d1d3a4c430db80b24124468
Author:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
AuthorDate: 2026-08-05 08:27:54 +0000
Commit:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
CommitDate: 2026-08-05 15:20:04 +0000

    rtadvd(8): Fix RA flag inconsistency messages

    During flag inconsistency report, we handle rai->rai_otherflg
    as a bool, but the value is 0x40. Make it a simple number comparison.

    PR:             295995
    Reviewed by:    markj, Faraz Vahedi <kfv@kfv.io>
    MFC after:      3 days
    Differential Revision: https://reviews.freebsd.org/D58672

 usr.sbin/rtadvd/rtadvd.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
Comment 3 Pouria Mousavizadeh Tehrani freebsd_committer freebsd_triage 2026-08-05 15:23:06 UTC
Thank you for your report.
Sorry for delay!