From nobody Tue Jun 30 17:19:11 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqVHg6QgSz6jXgB for ; Tue, 30 Jun 2026 17:19:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqVHg3JHMz3nGL for ; Tue, 30 Jun 2026 17:19:11 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839951; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=g3HKd3AEdKjmtus7cfaj0bEFe1mdMFk5FE72HNSeGWk=; b=CncN8s7c55BXFhZ/DAXYxNTjI3ryTB9YyFHd+7B3A/laxe/5R503JgQ9w5DmLXv1LdCuTB qedUOSAFIDAGV5RkakmPC7VqQ/y/xW9I7Le6GR3f1uPjP1xa0d5VJzub84C3ODk2kGz8x6 8k9HPm0KCPm8seJ4KVeNKhHq4pAkPtC3x7dXjP6MIcD4KXsa9VQK33QqkfoLZE7jgwDCZh 4IJK6E6XLHL4AzGewUYSJmildK4TE9jxpjpsV6mVJImXPjbHfD6f/Lcx+ds7XzrsQeOOu0 3mWIfK5qbNfKKDJXL6W1untVpd1wsYioNMGUgqXf4SxXmmPV7lVbS5ATNBpRow== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782839951; a=rsa-sha256; cv=none; b=VogggDEr8T0UqFiAT2zE46K3CQZX3ujsLpWalh6LZMKiAfIySVCt3gf1ipUeiWcjhOuefg RTsdVObi4BXdcP+M4aK+dU0EmJs+5xyvq7d40XkuXxWSTfhYGeG8RvWD+u4940YNSbDPZl XTvEBZTiiHUWJfMlEoRXBo2r7ZvSEq48mPtFAh6q5oJBRMWHXZKvll9suHYUDB4TMORaeS GQoQk7+Zn11zjVFIc/3kJQ4M/7WgQELPN5gAkOmSy7VWFItUB5gPL68wb6wczku2Dnw0f6 IdigdXZYahc1JopxXKti+mQ5Hyg0+5PJhZpKKUHwXm/lCkmao0StdEPCXkX6oA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782839951; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=g3HKd3AEdKjmtus7cfaj0bEFe1mdMFk5FE72HNSeGWk=; b=eRJyWsVGP+8a0U8R7+27dWR05flWaHhrr36UrfMc1mmiGeAseTq8y0AEheBJG5AgRvNFNv yoLyWY3jqmhgkl1r4j5RGZVVe2doY+ZPZXEoeq9hC1frQdFCMCCcvrXGk83r38A77LI96C n8G8AU8Z7j8N4vZcwdOP0VX5vS5xM0/4jHMagcxYhd3xhrshrFnWrVNV8iFMKq/uxR8RIq rqxBFRVywtQONVn+N098ChDAmTVRrgt8RmgMfKNP2uG8JhfiWSBQ4hJ+P6jSc+K9y1JMqm +xuPIW1D89lm9uBR3nsOHTDdou3lwfJRXcOAWXwNE3iitD5bq4yQW1uEvKJ5cA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqVHg2Dl2ztRL for ; Tue, 30 Jun 2026 17:19:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 43aec by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 30 Jun 2026 17:19:11 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: eec9084656bc - main - rack: Reload the TCP stack PCB after reacquiring the inpcb lock List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: eec9084656bcd7dd52f8f564c96dc6aced5be554 Auto-Submitted: auto-generated Date: Tue, 30 Jun 2026 17:19:11 +0000 Message-Id: <6a43fa8f.43aec.368ee12c@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=eec9084656bcd7dd52f8f564c96dc6aced5be554 commit eec9084656bcd7dd52f8f564c96dc6aced5be554 Author: Mark Johnston AuthorDate: 2026-06-23 21:46:17 +0000 Commit: Mark Johnston CommitDate: 2026-06-30 17:00:23 +0000 rack: Reload the TCP stack PCB after reacquiring the inpcb lock Malicious userspace might switch TCP stacks twice while the inpcb lock is dropped. If it does so, the validation of tp->t_fb might succeed, but the saved pointer to the stack PCB might be invalid. Reload it to avoid this problem, as BBR already does. Approved by: so Security: FreeBSD-SA-26:43.tcp Security: CVE-2026-49422 Reported by: Maik Münch Reviewed by: tuexen Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57791 --- sys/netinet/tcp_stacks/rack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index c37003698f0a..3a6a374318ca 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -24211,6 +24211,7 @@ process_opt: INP_WUNLOCK(inp); return (ENOPROTOOPT); } + rack = (struct tcp_rack *)tp->t_fb_ptr; if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_HYBRID_PACING) &&