From nobody Mon Jul 20 21:23:58 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h3tmv1151z6dSLy for ; Mon, 20 Jul 2026 21:23:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h3tmv0QH3z3C6g for ; Mon, 20 Jul 2026 21:23:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784582639; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zjijI9qDs9QftxvuOIkIfra9aF29Ki5W3zoaRR07AiA=; b=lliVOjDPD/eElERc89eN3EYTJ0P2Xn4wHVaSY6X0N1fm8EVojOvyUSSDgRvKyehnDjZM9D pHdChf1vjLxKNq+LLjtv0ckPV43iOIlt5KGKVM/VwT+7PlYesZWAKE5sijAKukpkLxYwaT stGM1yLKI5I7gBy8ZfD+Nzp4F7/R/YZpDDRHBbAeOwY3rmcHItoM09ZOkku72+Dl2U5syG C+ljHPRsyWDcXb/IYkHz7DIjoTy8QGBTc68Ij39MksJUHHXiqpUGHL3f9RvIQy2LxYNFFo 1VxztKhchgnwgXqDMpy9dhr3JNfuioB5uG5M9ADPnG5IFakm96jWXqin8/thRg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784582639; a=rsa-sha256; cv=none; b=LlHtnU13Ww0vdpGxW+iHuky0f2nqx/k2bDehNYFTgM6kXR7b0m3hfIjAzXyJqM5ZkeQATO nMxbQXJwKhJsmv6aSTWTfOQA+nrgL/mNhIEAy9YqmihmzyRXcSxIj9/ATnrDHOAGK8qZm9 INB2JozpnoqNOrLjkFVdL39kIeP/o0sYFJAkQE3B+R4iJTg3qKXZ2Tr47Oc6enUGuGkRFB ugvIV/uFPC+vG5+yl0+WrymgAY9X4mdmEP0k5tZiu+H+j0Xo5QU+VAyuHwRZDn+bYiZ5I3 LHp6VRZ82Skyh8nIg5Cr+L4Ysl5dLTV/BZz9eYY50f383WBdO+ytA3pJDERLYw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784582639; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zjijI9qDs9QftxvuOIkIfra9aF29Ki5W3zoaRR07AiA=; b=KSkP1sclOtG5EsERjeSKlF/HfhLfVleZYCewwxm56dR92oOrJKfecZoRXyZ89eEfauGOf8 i2oDDr72CJQ8MdNyt8rF5/+ma5wlTJ7hVxw0PEeu37i7ti0kjtR9C0NA2p4HabEglTYXgB ohGhkFR4vOss8AvN96AMMxtBp4cx9iiy80RVKqZLLsq6jHYNavQEAysFSE49v7myZi86X/ w2wtGh4zs+gbD5uRYASS6cpQlZgRukE3CyuiEGIemxZ4aVhAmdjAJibYXv2xjhnMwn84Ml SF7EG/cdTuytypUp7LlOy1WcssF4h53/sRxGGYEh88vTS6OBRZhSBMLevV19Hg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h3tmt66yzz4LK for ; Mon, 20 Jul 2026 21:23:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 20526 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 20 Jul 2026 21:23:58 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Pouria Mousavizadeh Tehrani Subject: git: e4a457d13576 - main - if_geneve: Fix mbuf leak on ip_ecn_egress List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: pouria X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: e4a457d1357621265265089a5ece71c368dd2e99 Auto-Submitted: auto-generated Date: Mon, 20 Jul 2026 21:23:58 +0000 Message-Id: <6a5e91ee.20526.4abadec3@gitrepo.freebsd.org> The branch main has been updated by pouria: URL: https://cgit.FreeBSD.org/src/commit/?id=e4a457d1357621265265089a5ece71c368dd2e99 commit e4a457d1357621265265089a5ece71c368dd2e99 Author: Pouria Mousavizadeh Tehrani AuthorDate: 2026-07-20 20:33:55 +0000 Commit: Pouria Mousavizadeh Tehrani CommitDate: 2026-07-20 21:21:54 +0000 if_geneve: Fix mbuf leak on ip_ecn_egress Free mbuf and increase IFCOUNTER_IERRORS if ip_ecn_egress() under geneve_input_inherit() decides to drop the packet. Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D58361 --- sys/net/if_geneve.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/sys/net/if_geneve.c b/sys/net/if_geneve.c index 59822045b77b..04873f0b7964 100644 --- a/sys/net/if_geneve.c +++ b/sys/net/if_geneve.c @@ -3125,16 +3125,12 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } iphdr = mtodo(m, offset - sizeof(struct ip)); - if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &iphdr->ip_tos) == 0) { - *m0 = NULL; + if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &iphdr->ip_tos) == 0) return (ENOBUFS); - } if ((sc->gnv_flags & GENEVE_FLAG_TTL_INHERIT) != 0 && info->ttl > 0) iphdr->ip_ttl = info->ttl; @@ -3148,17 +3144,13 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } ip6hdr = mtodo(m, offset - sizeof(struct ip6_hdr)); itos = (ntohl(ip6hdr->ip6_flow) >> IPV6_FLOWLABEL_LEN) & 0xff; - if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &itos) == 0) { - *m0 = NULL; + if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &itos) == 0) return (ENOBUFS); - } ip6hdr->ip6_flow |= htonl((uint32_t)itos << IPV6_FLOWLABEL_LEN); if ((sc->gnv_flags & GENEVE_FLAG_TTL_INHERIT) && (info->ttl > 0)) @@ -3176,10 +3168,8 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } info->isr = NETISR_ARP; break; @@ -3188,7 +3178,6 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); } - *m0 = m; return (0); }