From nobody Tue Jun 30 17:19:52 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJT3KhWz6jXqD for ; Tue, 30 Jun 2026 17:19:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJS5qR1z3pd8 for ; Tue, 30 Jun 2026 17:19:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839992; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LxWdgaQnAwmsf90XT7AMyD+23m4ev850nTeW/u+i+t0=; b=LMdcvKO7noC6hRvuq6UoZE3uPxSIiKCHkAVA0O8kWPRNvgQCZ9dQhNcbaJxsAmfPOn2XAR byv7MUsVEUkzUIegDaKJaOUvoeNJ1EnIslOEoChiY/H90YLILf3GSJlcMuacArlr3jVWIF QBtx8KN9A+zQ/Z+ek9DDIPydeKFWQUkdRoopWBryVnhyexZtca4pF7abyA4PL3UShJNcMU inRiabUfkpxvBzdeIi6E/BxUhwaHGDhb3ooNhj/3JpL1wSqk+TcmqV3XMPIajXG+Sp+Hza PaPC8W1NSeBEM0x8ECwPGKZNa6TeYvAunsqaugG0to2Ox85Iw2E3VKj7w0zTUg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839992; a=rsa-sha256; cv=none; b=e3fudeLWVPcPzxi9tCumcAr4EiWX71qqmA28i9eU/GtOwXcQ7ivCAl//QshBfdhAas9xL9 0iha4yhRUdyxXfth9+VUn6BmzG9lOYl+gugGiAXLIfGaEp8LwDQMs0y59KGJN+Mv+RG7lB c3UoPSDRKMLim3wSzWrsHLgZLGQM76PIAbPk04U91m98JJfC5bNoNShKFqR9IPYu1NIVYW eXbquLbpMJtXjng0CSlrIt7/OnJI7+vSQy5JJpwgrT3jNe5n718/69AxD19LwJcZ+WhftR C0ZF8n/FaEDNIrN6WJliD3Npe/e4gsXNKRMD/98Bd8GStS74gfsckZL13jt9MA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839992; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LxWdgaQnAwmsf90XT7AMyD+23m4ev850nTeW/u+i+t0=; b=vBaTFGXcdsGSTuuadHk8Xr0D4VkDxbME442NdnBW1Fl3XWi0lOyVlryWpTVkIxV3BZblUe uuSbWLd4i0Sa/krf4+zLbh4pymL/ldGFEFnZ556OpgO1z1TAqQhu1ZG4LGkSoK4QWgrE3g PWh4hDjUuGXCSYb+XpVbcXme/BySpwZbfLHycgkrpoIhYEhY1dwYB+BnYD4dCizqckwsx1 5RgCorTztmm6f7hlh/nhhOCthuXneH3fwwiS6h4MJtavRge3AjWBDptZxia25wqovvv7kf Rpk25cL2dmeLRuxdALRc+VxS11MOW17jpvhsatPGUVPZq6cOxFxC/Om9b9W8KQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJS4w21ztXJ for ; Tue, 30 Jun 2026 17:19:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 43af4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:52 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: df8885512da5 - stable/14 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: df8885512da546e6ba619039625ec43a945b9889 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:52 +0000 Message-Id: <6a43fab8.43af4.6d1e5385@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=df8885512da546e6ba619039625ec43a945b9889 commit df8885512da546e6ba619039625ec43a945b9889 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:21 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 9b35fbb7797b..41a57eeedfde 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -23936,6 +23936,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) &&