This is definitely a real problem, but the fix goes a bit deeper, because the AAAA DNS record has to be changed when the name moves as well.

I think that

https://thekelleys.org.uk/gitweb-noai/?p=dnsmasq.git;a=commit;h=03fd0c19efbc68710bf96784adcbb402deef9726

Addresses all the issues.


Cheers,

Simon.


On 01/10/2026 00:00, Martin Vlach wrote:
slaac_add_addrs() won't create SLAAC addresses for a lease without a
hostname, but addresses already attached to a lease stay around if the
hostname goes away later, e.g. via kill_name() when another client
claims the same name. A matching ICMPv6 echo reply then makes
slaac_ping_reply() pass lease->hostname == NULL to a %s format, which is
undefined behaviour (glibc and musl just print "(null)").

Log "*" in that case, like the lease file code in lease.c already does.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
---
Another one from the same BudgetScan run. On glibc/musl it's purely
cosmetic ("(null)" in the log), so take it or leave it.

It can happen without DHCPv6: a second DHCPv4 client claiming the same
(client supplied) name makes lease_set_hostname() call kill_name() on the
first lease while that one still has an unconfirmed SLAAC address
(backoff != 0), and the echo reply then hits the log line. Found by
reading the code, I haven't reproduced it at runtime. Builds fine (macOS
only).

  src/slaac.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/slaac.c b/src/slaac.c
index ca92ac0..f696fdb 100644
--- a/src/slaac.c
+++ b/src/slaac.c
@@ -204,7 +204,7 @@ void slaac_ping_reply(struct in6_addr *sender, unsigned 
char *packet, char *inte
            gotone = 1;
            inet_ntop(AF_INET6, sender, daemon->addrbuff, ADDRSTRLEN);
            if (!option_bool(OPT_QUIET_DHCP6))
-             my_syslog(MS_DHCP | LOG_INFO, "SLAAC-CONFIRM(%s) %s %s", interface, 
daemon->addrbuff, lease->hostname);
+             my_syslog(MS_DHCP | LOG_INFO, "SLAAC-CONFIRM(%s) %s %s", interface, 
daemon->addrbuff, lease->hostname ? lease->hostname : "*");
          }
lease_update_dns(gotone);

_______________________________________________
Dnsmasq-discuss mailing list
[email protected]
https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss



_______________________________________________
Dnsmasq-discuss mailing list
[email protected]
https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss

Reply via email to