From nobody Mon Jun 22 13:26:26 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gkTVq0LcDz6hBl3 for ; Mon, 22 Jun 2026 13:26:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gkTVp3B7cz3rDt for ; Mon, 22 Jun 2026 13:26:26 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782134786; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0l6h8ER7oD1AwshkOPLQ1V9oB/aXhE8TS1vMc9SU4Gs=; b=QwDj51b+RAtBSHgdf1kfnhJuZcrrfccXZDzbgp5SpK7OrppC/g58QqCOpmCtJxZGZq/dGh qr8DCk8UvFun45MW1JQCX/zTqvjByxgcgSvq7kcZRNA/7gpYjExJ1uKsjo38t7UPCk6mkf vcL37cgWxS2pN2Fdtuqp5HYtApNZ4aNlP4omBIv819imQsmgNfFGWAGicb2rBxjzQvBsCM GshWkNL/H+N8wY4t1aFfdoYexZA7UU+aDegxQb6pdWvwwNySLfGiCSS9puwr7YKe1rCTxZ 5/5qp6IUV/PS9irfYAmneG0+8Od1NUbx5DiigaWMixNpACBz9oWokBoNs//ccQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782134786; a=rsa-sha256; cv=none; b=aO4zDp1DRzjD/gwsyksmze1uX3aG4aHNsGCx2hhLINGKhbCxRwFW1RK2Uoog1MRIcRd1GO ihexyTCHkH8uStuUm6O4KRNmbQeqrfzuWiic8pxp0VD6T12Eve088ts7Fu3YLcfh40bMQm +ZxmioDU8i7OwoNPknfUEahGE/dpL1AaoEs+2uRmGb7kev80iHkpeBwrWoKegLQ/6VNdO1 var3RtTdMcis1N/xcxCaTharkM0GStmFvHEISl5AT+NXOntAczd+AZps6BFSg0U/WiGxCo fdDwxA7OIJnhtokdNUESrLMXxVHaUNsreU8cwp4nSxe7Jt5e/3sBIamGOe5fvA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782134786; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0l6h8ER7oD1AwshkOPLQ1V9oB/aXhE8TS1vMc9SU4Gs=; b=YOz/RFflaM5r8CSiWBzA7MKQ1hUBkdkiijMirgMdh9zSq18cQDccaI/XY3yuQxgttml6ce iXxQ8k+XqdpwOEy/1qEBncpJk/VeD1O9pFqSmeyFYxNNnVNXZFXEu8cZY8haqN/iF/i+8Y unxdO/ndWkUtBSVpPdWrNjvlAG0W+VE+1kj2a98U087mfyplTaHwG4akN+v5yyoXuTBR6u GkA63rY0nVwB4s7YJqnvZeupi5fT3yFEF/nAPQptS462YBKv95muUcgvMk7WNiDHnEiiUl hRLoRw7BHlUd9oAkaVxkiUZpy4R2PNvn44AdcWTMBgDIetA1cNNc5TYJ2S5gEQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gkTVp25PPzpNy for ; Mon, 22 Jun 2026 13:26:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 39fd1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 22 Jun 2026 13:26:26 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: f3b14134dec1 - stable/15 - rpcsec_tls: Avoid a socket reference underflow in rpctls_server() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: f3b14134dec11c2f09980f25c4c60accbfea0f1e Auto-Submitted: auto-generated Date: Mon, 22 Jun 2026 13:26:26 +0000 Message-Id: <6a393802.39fd1.3492ec2d@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=f3b14134dec11c2f09980f25c4c60accbfea0f1e commit f3b14134dec11c2f09980f25c4c60accbfea0f1e Author: Mark Johnston AuthorDate: 2026-06-15 15:52:24 +0000 Commit: Mark Johnston CommitDate: 2026-06-22 13:26:09 +0000 rpcsec_tls: Avoid a socket reference underflow in rpctls_server() The upcall_sockets tree owns a ref on any resident socket. When a socket is removed after a TLS handshake failure, rpctls_rpc_failed() thus calls soclose(). rpctls_server() does not acquire an extra ref to compensate for this. So, if the upcall fails, e.g., because rpc.tlsservd is not running, we'll call soclose() to drop the reference, but this effectively releases the xprt layer's reference. Fix the problem by explicitly acquiring a socket reference when adding a socket to the upcall tree. PR: 289734 Reviewed by: rmacklem, glebius MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57555 (cherry picked from commit fc7993cf2d6ddba9f94683565838bf8fabc0145c) --- sys/rpc/rpcsec_tls/rpctls_impl.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/sys/rpc/rpcsec_tls/rpctls_impl.c b/sys/rpc/rpcsec_tls/rpctls_impl.c index e1b80217263f..621f6bcac3e4 100644 --- a/sys/rpc/rpcsec_tls/rpctls_impl.c +++ b/sys/rpc/rpcsec_tls/rpctls_impl.c @@ -190,7 +190,6 @@ sys_rpctls_syscall(struct thread *td, struct rpctls_syscall_args *uap) CURVNET_RESTORE(); return (error); } - soref(ups.so); if (ups.server) { /* * Once this file descriptor is associated @@ -277,6 +276,7 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, if (stat != RPC_SUCCESS) return (RPC_SYSTEMERROR); + soref(so); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -294,9 +294,16 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, stat = rpctlscd_connect_2(&arg, &res, rpctls_connect_handle); if (stat == RPC_SUCCESS) *reterr = res.reterr; - else + else { rpctls_rpc_failed(&ups, so); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + CLNT_CONTROL(newclient, CLSET_TLS, &(int){RPCTLS_INHANDSHAKE}); + } + /* Unblock reception. */ CLNT_CONTROL(newclient, CLSET_BLOCKRCV, &(int){0}); @@ -388,6 +395,7 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, uint32_t *gidv; int i; + soref(xprt->xp_socket); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -407,9 +415,18 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, for (i = 0; i < *ngrps; i++) *gidp++ = *gidv++; } - } else + } else { rpctls_rpc_failed(&ups, xprt->xp_socket); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + sx_xlock(&ups.xp->xp_lock); + ups.xp->xp_tls = RPCTLS_FLAGS_HANDSHFAIL; + sx_xunlock(&ups.xp->xp_lock); + } + mem_free(res.gid.gid_val, 0); #ifdef INVARIANTS