git: b9db5a5b1647 - main - in_mcast: Fix uninitialized variable usage in inm_merge()

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=b9db5a5b16477863654f92ec653e8464528ef981

commit b9db5a5b16477863654f92ec653e8464528ef981
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-08-11 16:42:41 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-08-11 17:02:40 +0000

    in_mcast: Fix uninitialized variable usage in inm_merge()
    
    When the first loop in inm_merge() hits an error, generally because it
    hit some limit on the number of source filters for a multicast group,
    inm_merge() tries to atomically roll back changes to the group source
    filter list.
    
    To roll back, it iterates over the global source filter list for the
    multicast group, starting at the last entry that we updated ("nims").
    But, if we have not yet updated any entries, this variable is
    uninitialized.  Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
    doesn't visit any source filters in this case.
    
    All of the above applies to the v6 case.
    
    Reported by:    Daniel Birtwhistle
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
---
 sys/netinet/in_mcast.c   | 1 +
 sys/netinet6/in6_mcast.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/sys/netinet/in_mcast.c b/sys/netinet/in_mcast.c
index ad908b72c340..e81096859770 100644
--- a/sys/netinet/in_mcast.c
+++ b/sys/netinet/in_mcast.c
@@ -1018,6 +1018,7 @@ inm_merge(struct in_multi *inm, /*const*/ struct in_mfilter *imf)
 	 * Maintain a count of source filters whose state was
 	 * actually modified by this operation.
 	 */
+	nims = NULL;
 	RB_FOREACH(ims, ip_msource_tree, &imf->imf_sources) {
 		lims = (struct in_msource *)ims;
 		if (lims->imsl_st[0] == imf->imf_st[0]) nsrc0++;
diff --git a/sys/netinet6/in6_mcast.c b/sys/netinet6/in6_mcast.c
index 036d58e5bd92..49b0537454df 100644
--- a/sys/netinet6/in6_mcast.c
+++ b/sys/netinet6/in6_mcast.c
@@ -1042,6 +1042,7 @@ in6m_merge(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf)
 	 * Maintain a count of source filters whose state was
 	 * actually modified by this operation.
 	 */
+	nims = NULL;
 	RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) {
 		lims = (struct in6_msource *)ims;
 		if (lims->im6sl_st[0] == imf->im6f_st[0]) nsrc0++;