From nobody Tue Jun 30 17:22:00 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLx2m4Pz6jZ5Z for ; Tue, 30 Jun 2026 17:22:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLw5rxWz3t3F for ; Tue, 30 Jun 2026 17:22:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840120; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0EOBHKMRv8m0oknoUoXxtCM2xdeMhtVY1muDxOYGKO4=; b=L5WXtBNs1q+J8JP778kKz0dT7HFQv3fgMqxvl9wQUWIuRM88bAsHZDl+W8Q7XzUZmSFFLi Z7U57NgXG9rz/0T97Sn6LIQAVR1wzAyDxfHQE7avG2AzobO/F8wOKKF4419685VLvzAT2y POZtsp1Ez4rFCh2/kL44S4GEZYjNlwV1p84vs809H98jyWaSO47FEQZEHFS4n8Pv8J3eVL HURt/93MSPUVD1LgV3T0cIL/UswXIp3H9eQU27QoA755akiPIuyc+4hacWN3msr0eQkUJf DoIII3+wlNYZnzClON8KsiPhBPkbUtNn+wYWD7N0qVBcZhOh2+r3mW2lzGP5/A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840120; a=rsa-sha256; cv=none; b=iCeF7M67KK0bIhoFiSyKeiV8obZsl3k2Pk0KODawO8nU6ZxmG45W8JpbQEUsZFGEvd5W0L FhE5uQ6XWyaWKbnoIaYWwlE9tXv4/F87u5kFzsLJx2vHZRPw8SlXb1EsE3BiLxC2rl3f3X 0MzioDK1usSYngUP9ULKzNBfVF565O8cneZJfdPJv66N9MQEpMXyd2A9U+lWtimwgEoFov nkw+jvUlgn5QwQ82/anZnHA3qkZZuuMXjSEQ54eAY2SOXcl7kmTzi8QbInYgRYNEPiFc9d 7XamLd+Ho1V8vzf8KpjKE0FvM5rvCnim0Cwu+qcyTSC8/o2WZn8tlxNmLa/NLQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840120; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0EOBHKMRv8m0oknoUoXxtCM2xdeMhtVY1muDxOYGKO4=; b=pWC0bTAKCTn9Sk6Lh0W0ac13F+8Bk4e4mGJYyD87DtRndclgalSe0AdFD/tuO74X/pGKar 5e4NIMtsV8gvSVQsctUF5JzpHMTfwtrLu7OHH8OjZMZdaYwBrV48H7v7Urfx3AXDpCUi7E cOTjkNgg2Y+25zwINtT6R3D81Xg8k3luuQP0SmRC25nnR8X1fJWNOGveeq1X0Ky4dY/9E/ LBv8qweVWVE91B+khJ0QivEXSn57tIG3EBDc4uVBACNJ5vYFzxXZJgV8q7x8pxLN64kAEf l9A2zjcZc2KThJbnkkVe+2QvtSJ9WRO+plLJuyAFFeqYIZ/4Nkrg1obzLc/puw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLw4SYRztkh for ; Tue, 30 Jun 2026 17:22:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45d49 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:22:00 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 490e506a1ca8 - releng/15.1 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 490e506a1ca8e766340fdea1a72eeea27e006293 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:22:00 +0000 Message-Id: <6a43fb38.45d49.77d4b6cb@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=490e506a1ca8e766340fdea1a72eeea27e006293 commit 490e506a1ca8e766340fdea1a72eeea27e006293 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 219cf2758ff2..86ea34f46a05 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -24136,6 +24136,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) &&