Bug#1006271: network-manager: crashes if DHCPv6 server sends multiple IPv6 addresses

[Mad Horse]

Package: network-manager
Version: 1.35.91-1
Severity: important

Dear Maintainer,

network-manager 1.35.91-1 and 1.35.92-1 will abort if DHCPv6 server sends
multiple IPv6 addresses,( as under a default-configured openwrt router )
because
in this case, nm_dhcp_utils_merge_new_dhcp6_lease() would call
nm_l3_config_data_new_clone() with ifindex=-1, which may originally result
ifindex = src->ifindex; but now in order to make such effect, ifindex
should be
set to 0 instead a negative value, otherwise such call will abort
network-manager for violating the assertion nm_assert(ifindex >= 0) in
nm_l3_config_data_new_clone().


-- System Information:
Debian Release: bookworm/sid
APT prefers testing
APT policy: (900, 'testing'), (500, 'unstable'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.16.0-1-amd64 (SMP w/4 CPU threads; PREEMPT)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=zh_CN.utf8, LC_CTYPE=zh_CN.utf8 (charmap=UTF-8), LANGUAGE
not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages network-manager depends on:
ii adduser 3.118
ii dbus 1.12.20-3
ii libaudit1 1:3.0.7-1
ii libbluetooth3 5.62-2
ii libc6 2.33-6
ii libcurl3-gnutls 7.81.0-1
ii libglib2.0-0 2.70.4-1
ii libgnutls30 3.7.3-4+b1
ii libjansson4 2.13.1-1.1
ii libmm-glib0 1.18.6-1
ii libndp0 1.6-1+b1
ii libnewt0.52 0.52.21-5+b1
ii libnm0 1.35.91-1
ii libpsl5 0.21.0-1.2
ii libreadline8 8.1.2-1
ii libselinux1 3.3-1+b1
ii libsystemd0 250.3-2
ii libteamdctl0 1.31-1
ii libudev1 250.3-2
ii policykit-1 0.105-32
ii udev 250.3-2

Versions of packages network-manager recommends:
ii dnsmasq-base [dnsmasq-base] 2.86-1.1
ii iptables 1.8.7-1
ii libpam-systemd 250.3-2
ii modemmanager 1.18.6-1
ii ppp 2.4.9-1+1
ii wireless-regdb 2021.08.28-1
ii wpasupplicant 2:2.9.0-23

Versions of packages network-manager suggests:
ii libteam-utils 1.31-1

Versions of packages network-manager is related to:
ii isc-dhcp-client 4.4.1-2.3

-- no debconf information

[Mad Horse]

A patch like the attached one should be able to fix this problem.

[Mad Horse]

Upstream issue
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/907
is related to this bug, and it is fixed with
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/5402a7217964205aa6041324fa0fd393bfbb4838