From nobody Tue Dec 16 23:43:24 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dWD5S4Kk8z6LPtx for ; Tue, 16 Dec 2025 23:43:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dWD5S2CFtz3Gqb for ; Tue, 16 Dec 2025 23:43:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765928604; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cbD9q15909q+wO5M26pymAlYzU8cWL+yK0pEi32H99g=; b=lD0OeYc4Zb4e9M1M9Mp1CPT8EmZDt+gwS/S3rPXmOADt+/7jA28Q8+Mrw0uyWyi9l8UVAE Em1IpcGxdWHAVQBEP4yEPL5v09vk5Rj6k12dxPeChYqrr6RjHArNUvbj1gFXSSs6lUdS+d Uop19/c3XYnBczDKnTNxrcH+XstePUBOYnWP5Uh6e9EbppNWqxQ4IchRY8IG48oG0KN/ux C+KFFFvESHveDtw92Ljf2vi/2EECjbMprnxpQF5+CNp3tInAgTSqaQYcDWqGw1y3kQ38fF zdslHZdcXfiFwr+vI1dsj5u04i2gOQfoN/N7/we+F9F8FHRl2a6+bUBlH31CQg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765928604; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cbD9q15909q+wO5M26pymAlYzU8cWL+yK0pEi32H99g=; b=VYnSUjo6TJ9W1+8HIPi/NVp50W673EBbhSmjAVjhik9Qd0b6h/QXyJ/DYrknkWyv2eKLZn JKKdMXHtmbAXqoDTqaGWhHfFubffANaQ2ovSs/3pk03VTeJYD9JTDA3H+TmwFd4mK8gDtg m+GlZ1smzufrFgQcI54Q1mwP3cW0AKEm3LmITcqgORHIN1jlt8+WYf3fQzkhsg03IF8Czc Myu/fBQNkd/8cReBGaVXQkVtotXh+pm3qwjTuDj91TnsGBM8VPUZxwDIM6GnovnDOZ9geb P1DN9KxjeGnSXZZdEn/kVdZdQSr1S4nDBqINpxHXKURbrCZYD+c9JxTcGb2aUA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765928604; a=rsa-sha256; cv=none; b=MUqa8rwJIh5z1mGdSAnnQK5K1kHkRTmktisXrb9xDSYSPrGDaocnJ7f0PfoSRCJP/slTYy nIoWManpGPshgkDXByBf+LdZ/j4llBWEDqORF3Ne87sv+1AqOWMrkYwSoFZrUp6G8po57u HSDwi1KlAppcfkZcKCpEBBg//woaDuTEQovPoFhJG1IZ1ra/R1oHRkHbPNWejvfIC+gdT5 0Z1hP8TXFd5dCjszhUWDcCm4m4HhnSLJuXKhq1IuZGQlKU/X58ajVyZRoBygnLDqh6Y2Pz x6JRUnf4L3Bc+/Ovz0b8w4DfwBIGINPG20dUgVKeThN1Z60JGHtAU2Mjz/2+VQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dWD5S1WsLzCXp for ; Tue, 16 Dec 2025 23:43:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 23f47 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 16 Dec 2025 23:43:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kyle Evans From: Mark Johnston Subject: git: c0cb68169beb - releng/14.3 - ipfw: pmod: avoid further rule processing after tcp-mod failures List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: c0cb68169bebc4210f9eccf643aeb73bf6d34654 Auto-Submitted: auto-generated Date: Tue, 16 Dec 2025 23:43:24 +0000 Message-Id: <6941ee9c.23f47.5df1abdf@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c0cb68169bebc4210f9eccf643aeb73bf6d34654 commit c0cb68169bebc4210f9eccf643aeb73bf6d34654 Author: Kyle Evans AuthorDate: 2025-11-01 17:34:11 +0000 Commit: Mark Johnston CommitDate: 2025-12-16 13:57:34 +0000 ipfw: pmod: avoid further rule processing after tcp-mod failures m_pullup() here will have freed the mbuf chain, but we pass back an IP_FW_DENY without any signal that the outer loop should finish. Thus, rule processing continues without an mbuf and there's a chance that we conclude that the packet may pass (but there's no mbuf remaining) depending on the rules that follow it. PR: 284606 Reviewed by: ae Approved by: so Security: FreeBSD-SA-25:11.ipfw Security: CVE-2025-14769 (cherry picked from commit c0382512bfce872102d213b9bc2550de0bc30b67) (cherry picked from commit deb684f9d1d6a3681e451d3af31f768c567f7dbe) --- sys/netpfil/ipfw/pmod/tcpmod.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/sys/netpfil/ipfw/pmod/tcpmod.c b/sys/netpfil/ipfw/pmod/tcpmod.c index d7400f4fd5ed..138fefe22a98 100644 --- a/sys/netpfil/ipfw/pmod/tcpmod.c +++ b/sys/netpfil/ipfw/pmod/tcpmod.c @@ -58,7 +58,8 @@ VNET_DEFINE_STATIC(uint16_t, tcpmod_setmss_eid) = 0; #define V_tcpmod_setmss_eid VNET(tcpmod_setmss_eid) static int -tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) +tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss, + int *done) { struct mbuf *m; u_char *cp; @@ -73,8 +74,10 @@ tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) * TCP header with options. */ *mp = m = m_pullup(m, m->m_pkthdr.len); - if (m == NULL) + if (m == NULL) { + *done = 1; return (ret); + } } /* Parse TCP options. */ for (tlen -= sizeof(struct tcphdr), cp = (u_char *)(tcp + 1); @@ -115,7 +118,7 @@ tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) #ifdef INET6 static int -tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss) +tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss, int *done) { struct ip6_hdr *ip6; struct ip6_hbh *hbh; @@ -143,13 +146,13 @@ tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss) /* We must have TCP options and enough data in a packet. */ if (hlen <= sizeof(struct tcphdr) || hlen > plen) return (IP_FW_DENY); - return (tcpmod_setmss(mp, tcp, hlen, mss)); + return (tcpmod_setmss(mp, tcp, hlen, mss, done)); } #endif /* INET6 */ #ifdef INET static int -tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss) +tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss, int *done) { struct tcphdr *tcp; struct ip *ip; @@ -163,7 +166,7 @@ tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss) /* We must have TCP options and enough data in a packet. */ if (hlen <= sizeof(struct tcphdr) || hlen > plen) return (IP_FW_DENY); - return (tcpmod_setmss(mp, tcp, hlen, mss)); + return (tcpmod_setmss(mp, tcp, hlen, mss, done)); } #endif /* INET */ @@ -207,19 +210,23 @@ ipfw_tcpmod(struct ip_fw_chain *chain, struct ip_fw_args *args, switch (args->f_id.addr_type) { #ifdef INET case 4: - ret = tcpmod_ipv4_setmss(&args->m, htons(icmd->arg1)); + ret = tcpmod_ipv4_setmss(&args->m, htons(icmd->arg1), + done); break; #endif #ifdef INET6 case 6: - ret = tcpmod_ipv6_setmss(&args->m, htons(icmd->arg1)); + ret = tcpmod_ipv6_setmss(&args->m, htons(icmd->arg1), + done); break; #endif } /* * We return zero in both @ret and @done on success, and ipfw_chk() * will update rule counters. Otherwise a packet will not be matched - * by rule. + * by rule. We passed @done around above in case we hit a fatal error + * somewhere, we'll return non-zero but signal that rule processing + * cannot succeed. */ return (ret); }