From nobody Tue Jun 30 17:21:28 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLJ5sm4z6jYbh for ; Tue, 30 Jun 2026 17:21:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLJ2nvcz3rtM for ; Tue, 30 Jun 2026 17:21:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840088; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ErhmJZ/IF6pOvu/ju56WJhNYwwxddcJXRUMJnOf0C6s=; b=HkTJNNBiHwMiM1QIEZdJagT9c8MXRQB2iJdloedVCrIhjqAOQgNBH6u4HOKP8FCggCpNjd i6kWij26C+UXPsT0VroLZKdBLKX5FpQ0oyYNDq/rCIGEoA8lEpxq/MhB+Qb/VqKkGCpa03 2i97KfQ1YQJVeC9DNVcK0XW+jruK4PFtIAiISj7wleQHzwJSpq9BGxuOxFDUTQy6l3wIK2 9TV6bUYmQIJqn+MJKJyuMIiWbBSMHejprcPxCMjRM74bTpcO3A9pbWYDEYeqSu0G/F/dvr NI42H3C6+axhgJ6LRBEHOd94iZ6urTtk7zl4byi5YeMhSzz4vXz2MSbUhmoUjQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840088; a=rsa-sha256; cv=none; b=tQDgV97ADxSKyF0D5sp99jlP8maWz6m/s1WR+JBgxO/xcmgS3fD1umXDlxGYQmbwJ74W7a buYODaKDnAZgUkmG7ckGzbeSC1yqweJUVEU1DpDVI6FwD3Ujdr5B+SwagOFEYPiUJmU1X2 LIPMTpOR5r+UdXMJsafrCklWLgVWaxYc2cTEUSK2IRqjKpEY6DL0E0sKEO6OwLvwm/OoEk 8PPOBzGkiycQGaDCuKiwEZJkpYixF8IaKpYmmJhDtRqF7LHPYKeoJEEpa1v9MCUgouhCB8 JFyovWcnjrecAEoWSoYYZxRKHR7TPcqG/RIu8TZpE2ps/2ltjy+p+TjaKJAg8w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840088; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ErhmJZ/IF6pOvu/ju56WJhNYwwxddcJXRUMJnOf0C6s=; b=QEkYXmiLG6uLLU4kdkZ6G6Aolr/zCQZn4PTJcFMi11oLAk40tuZtt2opkta6ULHWSB9R9s miAGjuOtIBpJkZihjMZiTrTzHC9YyA8pTGveBA3u/Ak4+FVfT/QuU4LwHu3dJPxkqbfRCO WQi9CEZRorPttYKbdxKLUP8D2xZl7eokswKJEC6tMni0njQlOYCHjUy9qJ5n1uZ+nkx2MR KqaqnDn06cKigbuyegDfgYFd9Svo2KZjlXhMcchBI+SpcFWwXSWeq2/wxz+McXSnuK2VGT Xvjxh5j4BfpIY+dkomHuMnJWXU4pdaTf1aoTiw28GhcJQuEzryylpDgWv2g18g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLJ1sSFztF7 for ; Tue, 30 Jun 2026 17:21:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 445cc by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:28 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 57b3853cc9bb - releng/15.0 - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 57b3853cc9bbe164a82844eb9a0d5196ff52a8e7 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:28 +0000 Message-Id: <6a43fb18.445cc.2a00bccc@gitrepo.freebsd.org> The branch releng/15.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=57b3853cc9bbe164a82844eb9a0d5196ff52a8e7 commit 57b3853cc9bbe164a82844eb9a0d5196ff52a8e7 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 02:32:57 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 9bc4530afe10..462bd6c6aa0b 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -24138,6 +24138,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) &&