From nobody Tue Jun 30 17:20:11 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJr372Mz6jXsd for ; Tue, 30 Jun 2026 17:20:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVJq6dD4z3q8g for ; Tue, 30 Jun 2026 17:20:11 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840012; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mxRoR1AzkCv9+3T2TQ1uIsQDQUg+Ji0PHlqBZtWOrIg=; b=LYPlUdswOUp5aTKdTjfh09At3wGZHe7zkiRP9grtxc5axINdD2pjyqtGNpT4bfOsUF9yti qV0JrYulgjsuP5H9EfQi5WFycoKqlP2BfHLwcOi6REOvMCID/h/U+5ER4EM3y8PCQ6XcPe E0IX2WVNNp6QkQqAVQ3rWEyVL7tH8P9VGDqUKSmTmNypzitRjIaaRl3yC0azpxAtPPd9Yu 0z1BG6X7/95Y90IijIdBUp8wlt53qXQEP8v7usxCsixJc7nujuzx69STT1IvQsNoa3QkEP c3n5Hslb018JTuOEwGeeqt53RLWQRf7ihgbz8v1Ul+9sadmTkCipJ9p//TosSQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840012; a=rsa-sha256; cv=none; b=mccIMHvVTtK11vxTyVL7fyLzNf2FBYQFWXnrrSvsnaCzBCpBmcN+F1ekntKOZlGOdiKQ08 AKkrpfWTkqlSGukf4tPMuxWl+9TtgIQqAvvb6594tfJSBIAJiXcQN1rrchdvc2x/7y54sC hT76qbNvwHWLhJy99bE4k3dDWAQI7t87pGGAJI3laC/E2jQsQCjew/qoueVwE94uITnc8p /MKF6G2Y9uOtLYbEg6Qj5lAgEsM1cH0PowifVQLE0YV0Qz6qltzgv6POt9Osg86fleKWOr MqlsUoaDkU62Y+M67v7cW9Izh0U+kksWk6Y5MYtXj6vJhxxoIDOEbFsDtldY+w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840012; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=mxRoR1AzkCv9+3T2TQ1uIsQDQUg+Ji0PHlqBZtWOrIg=; b=TsLPgmroiTqinpM0SbKsfXO7uycpLDiAyRR7RZOZNWpc7Yp4va6nhbPJs5fKdCXMFdNQd+ WDxGBo6RSiZG7AMhmnd6MEpbwqgHsEYpBctrmbzefVuCfRrkqVBUyUkEqqbGkgggS/KlRW ggRkBbqBV5sIeVwVJVtt2GTFNJtOb6Z30A1X5wjQBlNWBGR+2chZqbqDJuletl5hEhkBZc sUojirOJoe8ZbZdBrHFAerHSkNDEalOT2c+1dvyGRJg0rmIw1Iy55Z59dTT9f9tD6yVksH g1Rg0Hqn6d0BJb/s7Vxzggm+vvNQyNdh7jULOBV1bOsxdnGgl5x7+XZSUsRt3w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVJq5cJTzt9p for ; Tue, 30 Jun 2026 17:20:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4452c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:20:11 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: aed4c4dd9afc - stable/15 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: aed4c4dd9afce3059ab582315d9049544e447a93 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:20:11 +0000 Message-Id: <6a43facb.4452c.6a88177f@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=aed4c4dd9afce3059ab582315d9049544e447a93 commit aed4c4dd9afce3059ab582315d9049544e447a93 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:27 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 219cf2758ff2..86ea34f46a05 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -24136,6 +24136,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) &&