From nobody Mon Jul 20 21:23:58 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h3tn02VTpz6dSBV for ; Mon, 20 Jul 2026 21:24:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h3tn00x29z3C9D for ; Mon, 20 Jul 2026 21:24:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784582644; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zjijI9qDs9QftxvuOIkIfra9aF29Ki5W3zoaRR07AiA=; b=Htss+fPTjH3LdEUj2sLKyy5j1y4g2XprnN+XBg6x1kj3y293Nd9o1FQusPRVNad5pReYX+ db8NkkmvlH8wXIM8pHLSK1BUNwsQGdqMElK8I+3+DNUGMF6RzLPdll97XM6RONUBZua8eS nlkAxAlUOEIlDBw906YDk2I6oxRYmNXMYtun+fCe6/RgeL3GZ6mMMHUlGPjy7uSQOGdDii w9ivzme5RiZOIuA9LyZ9EoP5Bl/rT/nGVhVFLTYMzXxfmT5w4K3+88cwK25cTn5J78JJM2 q7RSOfrkUm6aTuXw44qEg2eVgm6BIxYDrMEBxMoI2isXFSvQKVrSTaSrL8vd5Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784582644; a=rsa-sha256; cv=none; b=xJ3XT98CfXRBUQqSvQMUvyqpxw/fykZWLoz4YVZCs/IjDzSuwHWSbisLXS0RVdLhra8vzc 8QnOZc3ATuN2VG+oh7EXA4eKLh0shnx49yXRpSwt4+GEvn4QrQxIOB21BtdcaC8H1lWSXG zvKivIAP2/B1gDq9baSsEPKrZWD8pJbflwKobl0qbs5jlUEt917R9O56mBwA7uwN8tM+N9 qZ5a3wGrdhzkepbxNLz0vqXrDvpLpBWmuoQs0qx/4t5+H/STHU02rimA4+K8loMFrBxewE mhNE1gQEg4cic+N94Xz45ix3QzZENOxERfcT5q0RkZrY/2+VSlyjOee0GSasfw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784582644; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zjijI9qDs9QftxvuOIkIfra9aF29Ki5W3zoaRR07AiA=; b=h0rzf49bm7W+woRGJJWLCNg+ahm3amWgzFH/znYYZImneHqiRtQxekB6aPDFJmBiq6xi5h iSYIDXQWo9F9xLFuOq49j0EFaPAPeHRt1+JxMih2aACX4rqEAAC74R6NvQSbJiqAXoTCmQ G0k1yv7TiPu+swqKTqyQRdtxlIvFQbXWVPhJZXmiiZ5DuOYmrFaw11STAmREjCISJobwD1 jvGS+oKRgx1ZfteRulF145GxrvplTFIXl12uzFAyFH1ueSPHdM/qnkL9XTpt5zqhWLIHKb LCxOedBjXmLhqhzbshQh7RMB7pp2s5aw8r+BKv9YkddY7EHA5Qm3Bkz83vuySw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h3tmz72g6z4LL for ; Mon, 20 Jul 2026 21:24:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 20526 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 20 Jul 2026 21:23:58 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Pouria Mousavizadeh Tehrani Subject: git: e4a457d13576 - main - if_geneve: Fix mbuf leak on ip_ecn_egress List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: pouria X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: e4a457d1357621265265089a5ece71c368dd2e99 Auto-Submitted: auto-generated Date: Mon, 20 Jul 2026 21:23:58 +0000 Message-Id: <6a5e91ee.20526.4abadec3@gitrepo.freebsd.org> The branch main has been updated by pouria: URL: https://cgit.FreeBSD.org/src/commit/?id=e4a457d1357621265265089a5ece71c368dd2e99 commit e4a457d1357621265265089a5ece71c368dd2e99 Author: Pouria Mousavizadeh Tehrani AuthorDate: 2026-07-20 20:33:55 +0000 Commit: Pouria Mousavizadeh Tehrani CommitDate: 2026-07-20 21:21:54 +0000 if_geneve: Fix mbuf leak on ip_ecn_egress Free mbuf and increase IFCOUNTER_IERRORS if ip_ecn_egress() under geneve_input_inherit() decides to drop the packet. Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D58361 --- sys/net/if_geneve.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/sys/net/if_geneve.c b/sys/net/if_geneve.c index 59822045b77b..04873f0b7964 100644 --- a/sys/net/if_geneve.c +++ b/sys/net/if_geneve.c @@ -3125,16 +3125,12 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } iphdr = mtodo(m, offset - sizeof(struct ip)); - if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &iphdr->ip_tos) == 0) { - *m0 = NULL; + if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &iphdr->ip_tos) == 0) return (ENOBUFS); - } if ((sc->gnv_flags & GENEVE_FLAG_TTL_INHERIT) != 0 && info->ttl > 0) iphdr->ip_ttl = info->ttl; @@ -3148,17 +3144,13 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } ip6hdr = mtodo(m, offset - sizeof(struct ip6_hdr)); itos = (ntohl(ip6hdr->ip6_flow) >> IPV6_FLOWLABEL_LEN) & 0xff; - if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &itos) == 0) { - *m0 = NULL; + if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &itos) == 0) return (ENOBUFS); - } ip6hdr->ip6_flow |= htonl((uint32_t)itos << IPV6_FLOWLABEL_LEN); if ((sc->gnv_flags & GENEVE_FLAG_TTL_INHERIT) && (info->ttl > 0)) @@ -3176,10 +3168,8 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } info->isr = NETISR_ARP; break; @@ -3188,7 +3178,6 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); } - *m0 = m; return (0); }