Commit 39a0e23585 for frr

commit 39a0e23585cd20a1a7cd879d425df220be740c02
Author: Louis Scalbert <louis.scalbert@6wind.com>
Date:   Mon Nov 2 14:23:22 2026 +0100

    nhrpd: do not bind a neighbor entry without peer

    The local cache entries, the interface address and "ip nhrp map X local",
    have no peer. When the kernel sends a who-has request for such an entry,
    nhrpd dereferences the NULL peer, when it logs the binding and when it
    uses the NBMA address of the peer because the request has no link layer
    address.

    Only the who-has requests for the valid neighbor entries reach that code
    for now. Answering the requests for the INCOMPLETE neighbor entries
    makes nhrpd crash, for example with a local map to an address routed
    through the tunnel interface:

    > ip nhrp map 172.16.1.99 local
    > # ip route add 172.16.1.99/32 dev nhc1-gre0
    > # ping 172.16.1.99
    > ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028
    >     #0 in nhrp_neighbor_operation nhrpd/netlink_arp.c:193

    A local entry maps a local address, there is nothing to bind. Ignore the
    entries without peer.

    Fixes: b3b7510464 ("nhrpd: link layer registration to notifications")
    Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>

diff --git a/nhrpd/netlink_arp.c b/nhrpd/netlink_arp.c
index 203a4f2b1b..db701559ec 100644
--- a/nhrpd/netlink_arp.c
+++ b/nhrpd/netlink_arp.c
@@ -185,7 +185,8 @@ int nhrp_neighbor_operation(ZAPI_CALLBACK_ARGS)
 					    : "del-neigh",
 	       &addr, ifp->name, &lladdr, ndm_state, c->used, c->cur.type);
 	if (cmd == ZEBRA_NEIGH_GET) {
-		if (c->cur.type >= NHRP_CACHE_CACHED) {
+		/* the local entries have no peer and nothing to bind */
+		if (c->cur.type >= NHRP_CACHE_CACHED && c->cur.peer) {
 			nhrp_cache_set_used(c, 1);

 			if (lladdr.sa.sa_family == AF_UNSPEC)