From nobody Tue Jun 30 17:21:00 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKn6C83z6jYGr for ; Tue, 30 Jun 2026 17:21:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVKn0Lsxz3r9R for ; Tue, 30 Jun 2026 17:21:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840061; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=o7RDYVaBugVmifiFNK1qlSD//tBz9Dp/TVOxtNZ5C5o=; b=QjXKctxSG/+uqMq08v41mIraw5z5wSxvxB/iR6uD3POpq6TfavJOnnW8dADZungMTvMP41 /IHdGhmYdNuCkfki749lyfDW2MINTEWN8m/L2YbTdLkAox1vUvK3IE66rOyun9RPLMJ8Iy caYtj5JdFglbFdMr8q4Ta08NJ1UDyTg5VMsUqpOGKbeA0hl/m/qJE/B7Vg0Rw9qQTWELN8 1i5YH1pWGMaXiwd9MJ1+eMxtL9HTQQ+ZAd6jpRaG9OjthrwuocyDBzHuGZmB9C42XiMPg0 bBc69BUjLTgW8eBuXGA2LF51FB7dxviycR9AwJPSQph3Flq+iLe44kLEOURSvg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840061; a=rsa-sha256; cv=none; b=KYpOjfsRYJTjuevjDtapIWh15ztfmWFAfztw3AlsMIF/jf1gzsvtxTJY5fHNk/ATsV1pLC 9++PAjn1HGm14kvrAA2E2ZThxhjvI8uCi9sEJMtNfFPh+44SNjgoa0tMwWlPBdrwEdQ/ZA MQlXYifZ07b9NYdEXCEuQKKuU3bghOAgO8Bcv+j8wWN2zqvOs6JNov/7hRS+A46ZI80hqK 4mJ5b14NOyBT57mq0Ajb6dKTGLyUSpHASN+iCtXYz20JD5HFO0IS9UKARbiZmevxrpnzt/ FWLhPpOtLplyJtUTOj8XTxNVtxELkLz5ImNv+54gSK5e4gsuVZZHrg3teqkWIA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840061; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=o7RDYVaBugVmifiFNK1qlSD//tBz9Dp/TVOxtNZ5C5o=; b=xJ6bNYaWKHv2SHV9x2zae0y2KdI/wWL4RsMqicg4fLWcy9dB515kqPxm3oqZDTzQ8yubBL xxjX5cSkwX1pL4xDQgPA4FyYSni+w9A31cQokyIskQ4LcrdApyGTCS8oIHLdRo0AfriZz1 N91oSZZQo+SiX50zaBzAzia9ax8lPzOUwVWcg4oR7uiztgZa7KlLFNRL7lv7FqZ1+Tq59/ 6pbhODwt/mthFpkVFXGibh/bpUmkdNF0lBxskjUebJlM1JPZaLxFbvhC51HQaju7v9Puo1 QudIKpN1uzaeIFI18JhiHB4V+dSzhQRUVeGeit9Z764ZdDPxXiV49rsGmJkJTA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVKm6CjPztBP for ; Tue, 30 Jun 2026 17:21:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45b92 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:00 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 800acf75eb80 - releng/14.4 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: 800acf75eb80d299fd8ba1e151050da58d481232 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:00 +0000 Message-Id: <6a43fafc.45b92.cc63fef@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=800acf75eb80d299fd8ba1e151050da58d481232 commit 800acf75eb80d299fd8ba1e151050da58d481232 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:17:30 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 9b35fbb7797b..41a57eeedfde 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -23936,6 +23936,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) &&