From nobody Tue Dec 16 23:43:32 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dWD5c2j41z6LPxY for ; Tue, 16 Dec 2025 23:43:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dWD5c1hZmz3H50 for ; Tue, 16 Dec 2025 23:43:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765928612; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZjZDojtYKk4tILlztY0w/a9/UFlBJA969/6+J4k6CuQ=; b=Fb2c1LWNd6t93LD/TOckIcY/oyeCEA+fEqCMdNb1O0OawZn1Wwq7q6WSCZQ9oWL7RjZcoE b18q2JvsAQFMFBflsy4GV4qwho5TvusUOlTOO1mHXxSg7Sw+0opJKMZ2apKVUG81oJcx/X v6ZY5XwvdK1kUri5rCRh2qoRCp60hnG0LcfbqSfoWt4inJrJ+slSZ4Bp5M25yuRDbo59zv h4djIO6GK035R0ng3vlDci4KR3eZFZxAMm9oTK/ZQPpD6Sj4Yzcg5cYwVpkZbOsxQs+kDb D4FS1h0PoCAHr3DZAazXY4gVw65vdA3KPOPQJkDvm28m+nLdfQvEZKhFI/+nKg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765928612; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZjZDojtYKk4tILlztY0w/a9/UFlBJA969/6+J4k6CuQ=; b=h+eFJ4XKJZ9R7K1eKB4AB3UIpXywzOlFahGE/5EvvLAbhi/fQsMla3sjRImfeERVT1cEwo ac+Th1/Yo/mZOmOtnZhyOhdBluQVuhvDotMGUOG/xoIZ/LKn5v0roVMtMGJjN9tI0OPylG zUALS0M0c1IEQaB9vRqFzPprOf+mIwsbeNFmJPEZipSLyZYabdV9G5BOv2cT2Exkt+LvrK 75Fzk6LgEYwBijhoicHmYtaAzxRMYPqZVhgDRmuUOrMtAnOqAb4UpipnWVmLSg12xJEMhm 1xh4EQciJey8f4uLsiMl77hiAuBT0uPs9lNL7Hc17dqtHaVXu/ESPqhaBtw1NA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765928612; a=rsa-sha256; cv=none; b=ZcfJ7KVdAzJP5+Pwep/gNSPaUgOGiLaigL+bB/3xSUDuogfFcEv49u+yDijDc62bDYcLzV akz7QOA8Pfsrte0mG0T5GTcA2+XgPjmE5JsQgmqPbE3cfwIHx2G9llRR164FuDCYym2tTF kC1OhvQbO1NTA5A7EiKh2hAyqOaELmDOFsEWFSBzPzEYkdvPK5MeV7Fk9Hkl8GEgCOhObf 7rk7lEIHxTBJSwqpvSqQAuDLiqngjMIJ2CQziYm4b+OAhvrdXS10aTmwhNMUOSoGfwy5nz bqN06k1ebgu45+S6zUOifZOdLL25Ioe2dfgxWe3j6j/iyu7OeDFcDudmXYZQZA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dWD5c0rllzBtS for ; Tue, 16 Dec 2025 23:43:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22fbd by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 16 Dec 2025 23:43:32 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Kyle Evans From: Mark Johnston Subject: git: 60026b06366f - releng/13.5 - ipfw: pmod: avoid further rule processing after tcp-mod failures List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/13.5 X-Git-Reftype: branch X-Git-Commit: 60026b06366f0178e2473441aaf9e601061c07a4 Auto-Submitted: auto-generated Date: Tue, 16 Dec 2025 23:43:32 +0000 Message-Id: <6941eea4.22fbd.61ad6091@gitrepo.freebsd.org> The branch releng/13.5 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=60026b06366f0178e2473441aaf9e601061c07a4 commit 60026b06366f0178e2473441aaf9e601061c07a4 Author: Kyle Evans AuthorDate: 2025-11-01 17:34:11 +0000 Commit: Mark Johnston CommitDate: 2025-12-16 01:55:38 +0000 ipfw: pmod: avoid further rule processing after tcp-mod failures m_pullup() here will have freed the mbuf chain, but we pass back an IP_FW_DENY without any signal that the outer loop should finish. Thus, rule processing continues without an mbuf and there's a chance that we conclude that the packet may pass (but there's no mbuf remaining) depending on the rules that follow it. PR: 284606 Reviewed by: ae Approved by: so Security: FreeBSD-SA-25:11.ipfw Security: CVE-2025-14769 (cherry picked from commit c0382512bfce872102d213b9bc2550de0bc30b67) (cherry picked from commit 94360584542abc49a1d947844cf4d8ca1369d4df) --- sys/netpfil/ipfw/pmod/tcpmod.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/sys/netpfil/ipfw/pmod/tcpmod.c b/sys/netpfil/ipfw/pmod/tcpmod.c index d7400f4fd5ed..138fefe22a98 100644 --- a/sys/netpfil/ipfw/pmod/tcpmod.c +++ b/sys/netpfil/ipfw/pmod/tcpmod.c @@ -58,7 +58,8 @@ VNET_DEFINE_STATIC(uint16_t, tcpmod_setmss_eid) = 0; #define V_tcpmod_setmss_eid VNET(tcpmod_setmss_eid) static int -tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) +tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss, + int *done) { struct mbuf *m; u_char *cp; @@ -73,8 +74,10 @@ tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) * TCP header with options. */ *mp = m = m_pullup(m, m->m_pkthdr.len); - if (m == NULL) + if (m == NULL) { + *done = 1; return (ret); + } } /* Parse TCP options. */ for (tlen -= sizeof(struct tcphdr), cp = (u_char *)(tcp + 1); @@ -115,7 +118,7 @@ tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss) #ifdef INET6 static int -tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss) +tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss, int *done) { struct ip6_hdr *ip6; struct ip6_hbh *hbh; @@ -143,13 +146,13 @@ tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss) /* We must have TCP options and enough data in a packet. */ if (hlen <= sizeof(struct tcphdr) || hlen > plen) return (IP_FW_DENY); - return (tcpmod_setmss(mp, tcp, hlen, mss)); + return (tcpmod_setmss(mp, tcp, hlen, mss, done)); } #endif /* INET6 */ #ifdef INET static int -tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss) +tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss, int *done) { struct tcphdr *tcp; struct ip *ip; @@ -163,7 +166,7 @@ tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss) /* We must have TCP options and enough data in a packet. */ if (hlen <= sizeof(struct tcphdr) || hlen > plen) return (IP_FW_DENY); - return (tcpmod_setmss(mp, tcp, hlen, mss)); + return (tcpmod_setmss(mp, tcp, hlen, mss, done)); } #endif /* INET */ @@ -207,19 +210,23 @@ ipfw_tcpmod(struct ip_fw_chain *chain, struct ip_fw_args *args, switch (args->f_id.addr_type) { #ifdef INET case 4: - ret = tcpmod_ipv4_setmss(&args->m, htons(icmd->arg1)); + ret = tcpmod_ipv4_setmss(&args->m, htons(icmd->arg1), + done); break; #endif #ifdef INET6 case 6: - ret = tcpmod_ipv6_setmss(&args->m, htons(icmd->arg1)); + ret = tcpmod_ipv6_setmss(&args->m, htons(icmd->arg1), + done); break; #endif } /* * We return zero in both @ret and @done on success, and ipfw_chk() * will update rule counters. Otherwise a packet will not be matched - * by rule. + * by rule. We passed @done around above in case we hit a fatal error + * somewhere, we'll return non-zero but signal that rule processing + * cannot succeed. */ return (ret); }