From nobody Tue Jun 30 17:21:19 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL804z9z6jYNH for ; Tue, 30 Jun 2026 17:21:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVL73xkRz3rhF for ; Tue, 30 Jun 2026 17:21:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840079; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vf6Aq7tby/c3CwG/JikHChhMQYxW7iPmSfGUBmQoDDQ=; b=rncADX5Ki7mcdd09EYnjbwpDTzEnKL7NEg6lul31yZBqJ/17jUp28NdETftJr7UO6hc8Gc KGLLRxO3lTrZoU859HfDYLOdECvzjOfikobZqZVvsKNfsJeDv4Jsoysmqg8eQlGdRIiZxw Mffhuc4XyNzfmDJTRkTSJ6tSfkMuULorn6ON7L26/8QdHSNgFbFBbCPHx3Yp4wTu1djRQL HPQJoCxvxeTc3K98MBPzFJOtmps6CBmewrP/zsVg6kH2TlNgMcrPby2cJB2vLBLd7R1//P nAzwtzsgvjGPTjR0sZm25FNgDTLUH9xFKIz11w4AOg80Subb2E5SR0LvS5/TPQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840079; a=rsa-sha256; cv=none; b=bdN9ODbwvvTL93f5XqH+Ekc4GofoCNL/9CMzP1hmaOtDE5Q66+2elNxejptXuUfHo+VOPN EkBSGvVIhZH0bRfJqbJJaC0RLSXZ+CtSk9FpTFJSepL1fO2E922AyfwdPpM4axvW92nAxX pA8ZSada9YXdw4X2GxGYM8+C7DZYyDGgxLSZ+3qRwsCQKbXvqdyPzGyllLJoDfV0LllshZ 2uSrcpbf1iF7oW8dmKVJxhmiv4havsA8KS9TjqIS325QPMmH4bzDA2oZCHI4SlxJdi3hvH ++Q6CA+34DRUZ1099muVF/RuUVYmGDOoBWUn374IYVbkk7mZod63PL2m/YYcgQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840079; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vf6Aq7tby/c3CwG/JikHChhMQYxW7iPmSfGUBmQoDDQ=; b=adXmk0Aa7Qm2Yni2WMLFmf7F958L+QeN9Jx+q0o3oFjijyEAbSrlH9svjNCGTcFWiP2O58 gVEsWhB9xYZbv1vHUkXQ/vJbK8vUsdFkOrrpjCqdkUZQ1s/IY9/vMv+VnN3Howy4saTPoU gtdOM5gHlPCoxHAAI790sahoiiGobR7EK4d3dsa/G21Rxvre/sqp0XBubdx5oMAk64ddjM b7Q2TXDGPBcKReMSdC8IQDsp5mPqbsA+zw1V+mhFdYAXyayw0pzjovSNKioGxw2set2OKp KOMmADx3vSc8TO1usNxrdylB5OclvY1vt3T57AqqPAM2seewGCY4lCafhe3YwQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVL72pLsztn6 for ; Tue, 30 Jun 2026 17:21:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 45fa8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 7b3373d4eb5f - releng/15.0 - rpcsec_tls: Avoid a socket reference underflow in rpctls_server() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 7b3373d4eb5f86345e743e1233866fa7b0ff6160 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:19 +0000 Message-Id: <6a43fb0f.45fa8.69b8edf8@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=7b3373d4eb5f86345e743e1233866fa7b0ff6160 commit 7b3373d4eb5f86345e743e1233866fa7b0ff6160 Author: Mark Johnston AuthorDate: 2026-06-15 15:52:24 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 rpcsec_tls: Avoid a socket reference underflow in rpctls_server() The upcall_sockets tree owns a ref on any resident socket. When a socket is removed after a TLS handshake failure, rpctls_rpc_failed() thus calls soclose(). rpctls_server() does not acquire an extra ref to compensate for this. So, if the upcall fails, e.g., because rpc.tlsservd is not running, we'll call soclose() to drop the reference, but this effectively releases the xprt layer's reference. Fix the problem by explicitly acquiring a socket reference when adding a socket to the upcall tree. Approved by: so Security: FreeBSD-EN-26:17.rpcsec_tls PR: 289734 Reviewed by: rmacklem, glebius MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57555 (cherry picked from commit fc7993cf2d6ddba9f94683565838bf8fabc0145c) (cherry picked from commit f3b14134dec11c2f09980f25c4c60accbfea0f1e) --- sys/rpc/rpcsec_tls/rpctls_impl.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/sys/rpc/rpcsec_tls/rpctls_impl.c b/sys/rpc/rpcsec_tls/rpctls_impl.c index 51fe270b13d9..4d5f30b7a60a 100644 --- a/sys/rpc/rpcsec_tls/rpctls_impl.c +++ b/sys/rpc/rpcsec_tls/rpctls_impl.c @@ -190,7 +190,6 @@ sys_rpctls_syscall(struct thread *td, struct rpctls_syscall_args *uap) KRPC_CURVNET_RESTORE(); return (error); } - soref(ups.so); if (ups.server) { /* * Once this file descriptor is associated @@ -277,6 +276,7 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, if (stat != RPC_SUCCESS) return (RPC_SYSTEMERROR); + soref(so); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -294,9 +294,16 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, stat = rpctlscd_connect_2(&arg, &res, rpctls_connect_handle); if (stat == RPC_SUCCESS) *reterr = res.reterr; - else + else { rpctls_rpc_failed(&ups, so); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + CLNT_CONTROL(newclient, CLSET_TLS, &(int){RPCTLS_INHANDSHAKE}); + } + /* Unblock reception. */ CLNT_CONTROL(newclient, CLSET_BLOCKRCV, &(int){0}); @@ -388,6 +395,7 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, uint32_t *gidv; int i; + soref(xprt->xp_socket); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -407,9 +415,18 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, for (i = 0; i < *ngrps; i++) *gidp++ = *gidv++; } - } else + } else { rpctls_rpc_failed(&ups, xprt->xp_socket); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + sx_xlock(&ups.xp->xp_lock); + ups.xp->xp_tls = RPCTLS_FLAGS_HANDSHFAIL; + sx_xunlock(&ups.xp->xp_lock); + } + mem_free(res.gid.gid_val, 0); #ifdef INVARIANTS