From nobody Wed Aug 19 21:04:02 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hQJw31j6Xz6pfQM for ; Wed, 19 Aug 2026 21:04:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hQJw26wRNz3lk5 for ; Wed, 19 Aug 2026 21:04:02 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787173443; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=K/48NVtmoLygupIuyGQs+xjKh4X6gOn5q7CfuCRSDhM=; b=SKNEAdzKr7xB6NlIuewQnKthjya4P4hqV3DrvEdA4cn35Et/xSC8pRyBll8qP698qI9ffs lEVfWTh9G+1NjiyTwXRsS1KqyWyapWAe9QsnJr1AqAXWG/QCXKvHx/zXl+jJK9+Lgb3Apm 0rNZsGcDWYHjsxKxSjQzWT2hWdyk+skcXu1mAjEulBV1v+O2x7o5YIuGshga3PZY0avANn bRML3TIybvkvj5IXiRoC8Yz0/KNo2Q6/MVLitBRQ2mGwiJfha42HZHAB5ZH5HPV4R0bUWP AHxoGgT7+iolDhK/T6OU2TUMhjLUmhPourUh/8Zp9BbxV7Odgr2Wz+z6bgV5ww== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787173443; a=rsa-sha256; cv=none; b=XpOmB/rjcZq0vRiItT5LuGREFQRW0FvpxOw2FvHLPRn0MB6cK8a6UDQ0b16TL8s6Po8jkO kiD3dxDhXom3asNs2kY8RStisjnipK0vo8daR2DAQS5ZbdT3mMmDP7XkWI/hXHFw/0El1d pxD5sKiKrToXaR3N4T5LzF3AGtIVketFVzfLfvgmHOmVMcTJG7UBskJ4p9jZF0wuyZGBNU RLJwd9ErySC+4OulWr3CJwbaZv4l+11Y2xTZszzTFaI2SjX8Oh6gFHAKZcvboD2He7C3uf G8VIpTYw9lw+9f+zFyImt4NmKQpQcbt8xEgHi9tmI4SFQWmAJROqdwabPqf72g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787173443; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=K/48NVtmoLygupIuyGQs+xjKh4X6gOn5q7CfuCRSDhM=; b=RtEmQbJ+Q5tdEUMYknhwYWVCtd+LKCwAq8ObhUukrjmYHWBbzVQsoPJefQHWxnQY6IzGSw Bi0/0JTlRT9hQtXJc6gHgFTHJTOxgUe7ved4QOJlZqr4BVF4NdbauFwSXFIA9uoypyzGyw uUyHLzGgyHlIJzdOpjFTRBXREQvc5gWOm/I1G5NpID+al4Xj4m+EZ7J4qb5TAvld51bk0M oVtjppsNnZaSDmmbFj7Gmwkk7rPSFp0mfZnEAYYjXogFUTavoZglitmIe7rFhNBkuHBdF6 1/9UvMaCx8sbCciVvN+7iimxfkm8h2808V/zpZjuvno6FnehAq0AO+QbK6k1Xg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hQJw25h6Tznqr for ; Wed, 19 Aug 2026 21:04:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 32c93 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 19 Aug 2026 21:04:02 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 843ef8961512 - stable/14 - in_mcast: Fix uninitialized variable usage in inm_merge() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 843ef8961512682f152266a6cec85de47c7b9396 Auto-Submitted: auto-generated Date: Wed, 19 Aug 2026 21:04:02 +0000 Message-Id: <6a861a42.32c93.51c26634@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=843ef8961512682f152266a6cec85de47c7b9396 commit 843ef8961512682f152266a6cec85de47c7b9396 Author: Mark Johnston AuthorDate: 2026-08-11 16:42:41 +0000 Commit: Mark Johnston CommitDate: 2026-08-19 18:08:59 +0000 in_mcast: Fix uninitialized variable usage in inm_merge() When the first loop in inm_merge() hits an error, generally because it hit some limit on the number of source filters for a multicast group, inm_merge() tries to atomically roll back changes to the group source filter list. To roll back, it iterates over the global source filter list for the multicast group, starting at the last entry that we updated ("nims"). But, if we have not yet updated any entries, this variable is uninitialized. Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM doesn't visit any source filters in this case. All of the above applies to the v6 case. Reported by: Daniel Birtwhistle MFC after: 1 week Sponsored by: The FreeBSD Foundation (cherry picked from commit b9db5a5b16477863654f92ec653e8464528ef981) --- sys/netinet/in_mcast.c | 1 + sys/netinet6/in6_mcast.c | 1 + 2 files changed, 2 insertions(+) diff --git a/sys/netinet/in_mcast.c b/sys/netinet/in_mcast.c index 4fd00bac3ae4..b379053706cb 100644 --- a/sys/netinet/in_mcast.c +++ b/sys/netinet/in_mcast.c @@ -1023,6 +1023,7 @@ inm_merge(struct in_multi *inm, /*const*/ struct in_mfilter *imf) * Maintain a count of source filters whose state was * actually modified by this operation. */ + nims = NULL; RB_FOREACH(ims, ip_msource_tree, &imf->imf_sources) { lims = (struct in_msource *)ims; if (lims->imsl_st[0] == imf->imf_st[0]) nsrc0++; diff --git a/sys/netinet6/in6_mcast.c b/sys/netinet6/in6_mcast.c index 4ec9f36cd9ac..0489e656555a 100644 --- a/sys/netinet6/in6_mcast.c +++ b/sys/netinet6/in6_mcast.c @@ -1039,6 +1039,7 @@ in6m_merge(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf) * Maintain a count of source filters whose state was * actually modified by this operation. */ + nims = NULL; RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) { lims = (struct in6_msource *)ims; if (lims->im6sl_st[0] == imf->im6f_st[0]) nsrc0++;