From nobody Tue Jun 30 17:20:34 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKG70bjz6jY6j for ; Tue, 30 Jun 2026 17:20:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKG4BJyz3qn1 for ; Tue, 30 Jun 2026 17:20:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840034; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9fTXEgi/SeHrWbAwn36R4163jtYwYTTYRfxMWIlM0+w=; b=dFM/lfvC4Z0XdfVUD0bHP+ht8EZSuZA6/9U+JYs1oK7uIpP5B2V/J1iLcYTBUTAZ5SOeQQ l+POU4phDaW4Wr9EV22y9dzm2//xFcZVpKB7P8pv8B2JFGW7kxjLngU8+Lk4//nZbdN8ye sliG/gtLXKEw0a5ndA6SekaBhw2pjKt+MceHnRVCR92p9znjLGwQsDS/4Ik/Fegw6xssr7 RJwPcEPX5lWreSJSDOzYnNleISlbjJilp+qfJQTIAkGXSuF/29lT7pic4clhqZ7HSkN3ZE uQwndsG8NGd/emP2Mfk1GQGoa3yJ0RZ9mpIGc2kKq9LBshQ5DdzeZdaGhB6L2Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840034; a=rsa-sha256; cv=none; b=LQ11bHeSlAdd0MBjw9d7c8WwjgGCOr1NsPcGO9O9PBYQfRhjKZAjaQYPIC5FMhv0vGa2V+ i3Zf9D/LmF4eyZzk8F7VlA2dfjTmjaxax1MukFvGek3/EQDzJgWl+OYd/V6M9HhTnBxwYJ Z0NkJljlglb+wzqnUzvWyQccOZlZUA2eo35o6NZH+Jwl8GhKfzhIizOGxmPQzoAf/OODaW xBIi9RfDxM8g+kn6fkbsYs40bqth92yPFpUuh/CHU3VZLvCmuum53AKp4elI2e5An1tXma DWlDyvxFOjaS+TnuijcGdyr0GgCfViuShPCwiw8b0Jhjvl8GnPlnI6GhkRv8yg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840034; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9fTXEgi/SeHrWbAwn36R4163jtYwYTTYRfxMWIlM0+w=; b=lgpoy3LZC44Pm3wH/WahJb0YYNBrd9AhUHh0UNuwIXtxE+Ufi0IyJBNAIaVjjEYEKISiK/ iTPcFni4O1/n0OZGyttY1GHGTfsv+Ysk8oqu1fdyJRtTmfMXlCUOS3DswRhiA937tk4KwL G/pDHgBZ/QsBU1gESQYUD6PfwxQ9F4XoKMQWNel72HeOm92cps6wU76IGbt8UCMBabneDr kT4oGKJMsNK4WLPdtL2+R/drQcMzdBGbJnpjDzjxzT1lXsU5hJPyt8zdqzwHyoa6a94IBy NyLEbNT8tO0KLc5/Yj2zVhhNiKqwQDm8acnE5A6h3wvYeaSxbhJ7PGovqcA+SA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKG34gcztDS for ; Tue, 30 Jun 2026 17:20:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45b8a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 8845978fec03 - releng/14.3 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.3 X-Git-Reftype: branch X-Git-Commit: 8845978fec035db3a9643d7f36843dfc7c6c68d8 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:34 +0000 Message-Id: <6a43fae2.45b8a.278628a4@gitrepo.freebsd.org> The branch releng/14.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8845978fec035db3a9643d7f36843dfc7c6c68d8 commit 8845978fec035db3a9643d7f36843dfc7c6c68d8 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:01 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index f90b747cc2e4..3d6734b6874b 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -23934,6 +23934,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) &&