From nobody Tue Jun 30 17:21:51 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLm45VJz6jYcS for ; Tue, 30 Jun 2026 17:21:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVLl6tt8z3sXW for ; Tue, 30 Jun 2026 17:21:51 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840112; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UCOdp+2kyCBJKWm+JthayyqRW0ZSqq58iwi2v+fmlyg=; b=Irns7TjAXMrEbA9+MsxwPukOEV9OHww4I9dyICyNFcFG/+hSEIpAmmspfr7LngbKhXoY8S YQbu+uHqpxOfnmzPcV+Q5S7RwmN8BHFYsh8SWm+faI9sNU3ojP8W9Ug+DlFeZ3bgPM3WSp hhvyl+9ADkaNVKC8AcsGLOHCD/TlMJQbC/eDxH3qKgYBVAgzoSAbberas4pzAFbrzXM3af ChkhTcRbKG9fOmeSck7NETPv69wQYwsor+Q8OXOKOq5+41B5T/wNDtIFe7D1juRjLjWOGF OdfE2wu9rKFHR3LW41HP8JWkRTp2cw+6HH+RO5NyI0ZALHVvCb3N8jsvwTVYVQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782840112; a=rsa-sha256; cv=none; b=czhq2MyEVddbnr89qN1u6k6pNdnJjNiGMLVjrYmuI2cQ8h37ZAytICyH0zGW/O72W+yOuY nae+fZREwMQWTeeBUYSzSHMWm9B4LadwFd3J9OiPsEWeptEUh1NmcAo5IQU3UVec+xEMZ2 tIHiGgfCWcAUM+NzPU7A7WppmYz5sPWlArNctKL8eW620HcYy4vow82nkMkkwBpee74RPC d1cbZfwEnG9Z4KWs+fbJZSVuHqq6vlSfjYGge7k79D1gybqpXKdVMldYFAx5bi3lrZCo/O Bp6IX4+4QBEEUy2y0+t+HOKM952pzT1lpU2Jy7VGQ7ma5RECpmemMyZOtf1aRA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782840112; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UCOdp+2kyCBJKWm+JthayyqRW0ZSqq58iwi2v+fmlyg=; b=iNeagkP5le6U/DyY+RDL3avT+NRZhoRj+FY4CI2dO7diy5hxbhXz4I3q9xb9mx4jH/7HZr n6JKTPhGZPNr5l2BoGf30lhTaCQZ4qq5ggC+8JVeddKAN/4rMjUgNNioGuoNiITwhXt57c 1iJna4uNKy+dATEwDgcWT0T0koen3rM7ycJQVTtRZZovd2nOKNwETPug+OMcjokymisOyk v8kL/7JQzmw9BI5ffDhWw3rYJEupEqpRCCVoC/u2yrFz0UDOZ2q47WGDR25x1vcr9JQcyJ c1Fq60hFgOeBhL9qT+01Gh+irMKyA+C+E9zS4aDrIpsWJTDP8sHmrkZURdQF1Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVLl5qWCztqZ for ; Tue, 30 Jun 2026 17:21:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 44762 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:21:51 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: c04ca8bd36f7 - releng/15.1 - rpcsec_tls: Avoid a socket reference underflow in rpctls_server() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: c04ca8bd36f778a8190e5aa3249075929a916dbe Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:21:51 +0000 Message-Id: <6a43fb2f.44762.421945ff@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c04ca8bd36f778a8190e5aa3249075929a916dbe commit c04ca8bd36f778a8190e5aa3249075929a916dbe Author: Mark Johnston AuthorDate: 2026-06-15 15:52:24 +0000 Commit: Mark Johnston CommitDate: 2026-06-29 19:16:40 +0000 rpcsec_tls: Avoid a socket reference underflow in rpctls_server() The upcall_sockets tree owns a ref on any resident socket. When a socket is removed after a TLS handshake failure, rpctls_rpc_failed() thus calls soclose(). rpctls_server() does not acquire an extra ref to compensate for this. So, if the upcall fails, e.g., because rpc.tlsservd is not running, we'll call soclose() to drop the reference, but this effectively releases the xprt layer's reference. Fix the problem by explicitly acquiring a socket reference when adding a socket to the upcall tree. Approved by: so Security: FreeBSD-EN-26:17.rpcsec_tls PR: 289734 Reviewed by: rmacklem, glebius MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57555 (cherry picked from commit fc7993cf2d6ddba9f94683565838bf8fabc0145c) (cherry picked from commit f3b14134dec11c2f09980f25c4c60accbfea0f1e) --- sys/rpc/rpcsec_tls/rpctls_impl.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/sys/rpc/rpcsec_tls/rpctls_impl.c b/sys/rpc/rpcsec_tls/rpctls_impl.c index 22ba699a6fab..d8d4a240e0b9 100644 --- a/sys/rpc/rpcsec_tls/rpctls_impl.c +++ b/sys/rpc/rpcsec_tls/rpctls_impl.c @@ -190,7 +190,6 @@ sys_rpctls_syscall(struct thread *td, struct rpctls_syscall_args *uap) KRPC_CURVNET_RESTORE(); return (error); } - soref(ups.so); if (ups.server) { /* * Once this file descriptor is associated @@ -277,6 +276,7 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, if (stat != RPC_SUCCESS) return (RPC_SYSTEMERROR); + soref(so); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -294,9 +294,16 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, stat = rpctlscd_connect_2(&arg, &res, rpctls_connect_handle); if (stat == RPC_SUCCESS) *reterr = res.reterr; - else + else { rpctls_rpc_failed(&ups, so); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + CLNT_CONTROL(newclient, CLSET_TLS, &(int){RPCTLS_INHANDSHAKE}); + } + /* Unblock reception. */ CLNT_CONTROL(newclient, CLSET_BLOCKRCV, &(int){0}); @@ -388,6 +395,7 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, uint32_t *gidv; int i; + soref(xprt->xp_socket); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -407,9 +415,18 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, for (i = 0; i < *ngrps; i++) *gidp++ = *gidv++; } - } else + } else { rpctls_rpc_failed(&ups, xprt->xp_socket); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + sx_xlock(&ups.xp->xp_lock); + ups.xp->xp_tls = RPCTLS_FLAGS_HANDSHFAIL; + sx_xunlock(&ups.xp->xp_lock); + } + mem_free(res.gid.gid_val, 0); #ifdef INVARIANTS