u-boot.git/net/dhcpv6.c, branch main

net: dhcpv6: Prevent out-of-bounds reads while parsing options

2026-06-03T15:22:24Z

dhcp6_parse_options() verifies that an option's declared data fits within the packet, but does not check that option_len is large enough for the fixed-size read each case performs. A malicious DHCP server can send an ADVERTISE with a zero-length IA_NA, STATUS_CODE, SOL_MAX_RT, or BOOTFILE_PARAM option, causing the parser to read 2-4 bytes past the option's declared data. Check option_len value before each dereference of option_ptr. Signed-off-by: Francois Berder

net: dhcpv6: Prevent buffer overflow during BOOTFILE_URL parsing

2026-06-03T15:22:24Z

The net_boot_file_name is a 1024 byte buffer. However, based on DHCPv6 RFC, bootfile-url length is specified by option_len, a 16-bit unsigned integer (valid range: 0-65535). Hence, one needs to make sure that option_len is less than the size of net_boot_file_name array before copying bootfile-url to net_boot_file_name. Signed-off-by: Francois Berder Reviewed-by: Jerome Forissier

net: consolidate PXE processor architecture type Kconfig

2025-06-26T14:17:17Z

DHCP and DHCPv6 use the same value defined in https://www.iana.org/assignments/dhcpv6-parameters#processor-architecture to encode the processor architecture type. We should only use a single Kconfig symbol for both protocols. Furthermore we should make the value customizable. This allows for instance to choose between "x86 BIOS" or "x64 UEFI". As "x86 BIOS" is encoded as 0, we should not use this value to switch off transmission of the DHCP option. Use 0xFF instead. Signed-off-by: Heinrich Schuchardt Acked-by: Ilias Apalodimas Reviewed-by: Tom Rini

net: dhcpv6: remove excluded middle expression

2025-04-23T07:58:07Z

!A || (A && B) is equivalent to !A || B Drop the middle expression from the statement Signed-off-by: Bryan Brattlof Reviewed-by: Jerome Forissier

net: dhcp6: Send DHCPv6 using multicast MAC

2025-04-23T07:58:07Z

In IPv6, the broadcast MAC address is not used. Instead, it should use the multicast address (see RFC RFC2464). Add IPV6_ALL_NODE_ETH_ADDR macro for clarity. Signed-off-by: Sean Edmond Reviewed-by: Jerome Forissier

Restore patch series "arm: dts: am62-beagleplay: Fix Beagleplay Ethernet"

2024-05-20T19:35:03Z

As part of bringing the master branch back in to next, we need to allow for all of these changes to exist here. Reported-by: Jonas Karlman Signed-off-by: Tom Rini

Revert "Merge patch series "arm: dts: am62-beagleplay: Fix Beagleplay Ethernet""

2024-05-19T14:16:36Z

When bringing in the series 'arm: dts: am62-beagleplay: Fix Beagleplay Ethernet"' I failed to notice that b4 noticed it was based on next and so took that as the base commit and merged that part of next to master. This reverts commit c8ffd1356d42223cbb8c86280a083cc3c93e6426, reversing changes made to 2ee6f3a5f7550de3599faef9704e166e5dcace35. Reported-by: Jonas Karlman Signed-off-by: Tom Rini

net: Remove and add needed includes

2024-05-06T21:05:04Z

Remove from all "net/" files and when needed add missing include files directly. Signed-off-by: Tom Rini

net: dhcp6: Fix OPT_BOOTFILE_PARAM parsing

2023-11-05T18:28:40Z

RFC 5970 states that OPT_BOOTFILE_PARAM (option 60) can be multiple parameters that start with a 16-bit length field followed by the parameter. For example: [ param-len 1 (16-bits) ] [ parameter 1 (variable length) ] This fix ensure we're considering "param-len 1" in the parsing. Signed-off-by: Sean Edmond

net: ipv6: Fix CID 453851 and CID 436278

2023-06-14T19:48:45Z

CID 453851 : sprintf() shouldn't copy from/to tmp CID 436278 : DHCP6 option_len should be checked before use Signed-off-by: Sean Edmond Reviewed-by: Ramon Fried