From nobody Tue Aug 11 08:42:39 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hK4rP34x4z6XC42 for ; Tue, 11 Aug 2026 08:42:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hK4rP068Lz43Jb for ; Tue, 11 Aug 2026 08:42:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786437765; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0NyhZHYBHW+Q6mdplzf6cuKDi+QB1TaGUTy/jPWfkAE=; b=Wlk5l9wZbsxrA42PwtPEu+qSfFyU1ejCzp00znnpsaXBBY9hHLhVzEnnF0qCZ9WZAoGyTY li6mhh1Q91oPwL4r63sYQuLo3C0vCVS9XAwl6JP+PK/9IRHn6Uo+JIqBgkNeB/9mlqkdr3 +yj2o2OHcGuHSFKB501IGZ+QqDFe9fXzaIi8qWjc3Eti5hXDNkDE3qtqVU7wZRRrX3WibW Tp7f3xRAunlUXmaj/F1n7Hrdb5JhxzCh1ZQOVFB/+vI6SFluiulcRx07SnDARDk1YOXTUL vLr95bPSdSuNvYlP7Iw0y4gi4l9CCRI96N2zhjMHQIAG9qSt99gsEPgCOggMRg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786437765; a=rsa-sha256; cv=none; b=ikZvCrV7Tv1FHhKdto9u7aZo+7Z0ZgdQ8gpyNwK2RvSVlyafXNtKJG2AjJHQZofBF2jBkB MHe6/habOx/DG1/DujOkVlTIP6UfWVjS6RKb/v1rtkIl64JbsqGeFfwxQoiBMUzHZSwXIP 1+mI2o8QgqCVpvtPJoaAFmUUMHyqBoDl/D+ORNJcco8Zvtjg69uSIL/9twWQkXTWWBA/CH 61W/pCPNaQxBIRVcFdVrrWtXqZIPNSS32batXsOpfdIvexyvZU3KCqku3mtZMlxuc6Pt9L 9mEjyj5rKasHuS3J/vtX9ih3aVlO2NYAtVN6tyq5olhfT7H1WICO9yh8MOhUmA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786437765; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0NyhZHYBHW+Q6mdplzf6cuKDi+QB1TaGUTy/jPWfkAE=; b=hl3DuO7SDw4eBG7mblxShAa/23JfPBGAg5Jgr0ZRRoUSqGSxuo8x+7FeaQAVHrsGRepuk0 q5vrWjRqez6sgskgtfhvcGHt0Gxj05vGuFHC/Y6xKMzdh+hsU75QeLWht3D7O6sFYvk+K4 6bcbrRAZ+x6FYbUuckE4Ww34Iv8RIzkRvBWeb2l1HmL+JM9t8GxkRkTVsqDNe3cC6467Xj /w0KZ/u1wXwyO1ezXbll2w8tlUBY0MfdpYhEyzmNdv6kW4YqOyxi7I2s2/0DqWFSYduMp4 L4GITZyksVeBbX4oJiUI8jm+EeDTmd6S2sNyH3bQfvqPXa4s13n4J5xCuA+AlQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hK4rN4wswznbC for ; Tue, 11 Aug 2026 08:42:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 30e47 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 11 Aug 2026 08:42:39 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: e4e4d1b5ed7b - stable/15 - pf: check if a group has a kif before dereferencing it List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: e4e4d1b5ed7b8a7239eb33fd27e32bafc63768db Auto-Submitted: auto-generated Date: Tue, 11 Aug 2026 08:42:39 +0000 Message-Id: <6a7ae07f.30e47.2097a0b0@gitrepo.freebsd.org> The branch stable/15 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=e4e4d1b5ed7b8a7239eb33fd27e32bafc63768db commit e4e4d1b5ed7b8a7239eb33fd27e32bafc63768db Author: Kristof Provost AuthorDate: 2025-09-02 08:46:26 +0000 Commit: Kristof Provost CommitDate: 2026-08-11 08:33:56 +0000 pf: check if a group has a kif before dereferencing it It's possible for interface groups to not have had a pfi_kkif assigned to them, so before we pass that pointer to pfi_kkif_update() we must check if it's actually set. We've seen panics such as this, where we get an address update for an interface that belongs to a group without associated pfi_kkif: Tracing pid 12 tid 100034 td 0xfffff80100d2a000 kdb_enter() at kdb_enter+0x33/frame 0xfffffe0067eed340 panic() at panic+0x43/frame 0xfffffe0067eed3a0 trap_pfault() at trap_pfault+0x3c9/frame 0xfffffe0067eed3f0 calltrap() at calltrap+0x8/frame 0xfffffe0067eed3f0 --- trap 0xc, rip = 0xffffffff8102ebd5, rsp = 0xfffffe0067eed4c0, rbp = 0xfffffe0067eed500 --- pfi_kkif_update() at pfi_kkif_update+0x15/frame 0xfffffe0067eed500 pfi_kkif_update() at pfi_kkif_update+0x1fc/frame 0xfffffe0067eed550 pfi_ifaddr_event() at pfi_ifaddr_event+0x82/frame 0xfffffe0067eed5a0 srcaddr_change_event() at srcaddr_change_event+0xa7/frame 0xfffffe0067eed610 in6_update_ifa() at in6_update_ifa+0xd52/frame 0xfffffe0067eed790 in6_ifadd() at in6_ifadd+0x29a/frame 0xfffffe0067eed8b0 nd6_ra_input() at nd6_ra_input+0xf65/frame 0xfffffe0067eeda90 icmp6_input() at icmp6_input+0x3c8/frame 0xfffffe0067eedc10 ip6_input() at ip6_input+0xa15/frame 0xfffffe0067eedcf0 sppp_input() at sppp_input+0x502/frame 0xfffffe0067eedd80 pppoe_data_input() at pppoe_data_input+0x1e7/frame 0xfffffe0067eeddf0 swi_net() at swi_net+0x128/frame 0xfffffe0067eede60 ithread_loop() at ithread_loop+0x239/frame 0xfffffe0067eedef0 fork_exit() at fork_exit+0x7b/frame 0xfffffe0067eedf30 fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0067eedf30 Note that pf doesn't assign pfi_kkif objects to groups created before pf has fully started (see V_pf_vnet_active check in pfi_attach_group_event()), which is one possible way for this to happen. Reported by: garga Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit dc0cf0648c8d28ab4914c798a4cff8256ae94ee5) --- sys/netpfil/pf/pf_if.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/pf/pf_if.c b/sys/netpfil/pf/pf_if.c index e2200c15c704..f3be036ef745 100644 --- a/sys/netpfil/pf/pf_if.c +++ b/sys/netpfil/pf/pf_if.c @@ -655,8 +655,10 @@ pfi_kkif_update(struct pfi_kkif *kif) /* again for all groups kif is member of */ if (kif->pfik_ifp != NULL) { CK_STAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next) - pfi_kkif_update((struct pfi_kkif *) - ifgl->ifgl_group->ifg_pf_kif); + if (ifgl->ifgl_group->ifg_pf_kif) { + pfi_kkif_update((struct pfi_kkif *) + ifgl->ifgl_group->ifg_pf_kif); + } } }