From nobody Thu Aug 20 17:53:51 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hQrf81jVFz6pFWg for ; Thu, 20 Aug 2026 17:53:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hQrf80t5Fz41Kf for ; Thu, 20 Aug 2026 17:53:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787248432; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cfBLI7yHkgk622qAR89y7dJuspwD7Q8FdRGSDzRHW3w=; b=OZiMdEx6ZhaP6pQvZTJLdzFdXlVXWQbWRlHhh4trIlO5FJ7oah4PAppQ+4GDUZ4EFo6cup ED3epP29sLY9S6x8KfNN2kQ5GMt8acCTsg+UBTMwoSS6ROTId1cnBTnqCo3Iy6FMvz4BwG cE94cw5hQI+nHZAhnrrj7/lg++66X54jGnxPuaaNobfgUTrtRLH4ZC9Vto9UeZWsmbgMfE bLP1Us7Q7meHnNx0ObZCw7jSJtrUujeKjGrhCh+G8b3qTBE3ogA4vFZqLAt5HbRMu442cy LhZSrMZXwHuTPoZVnxAqA6KHGZ4DHGD0TmcBRNzVJpgkK/vvbReCkS+O562krQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787248432; a=rsa-sha256; cv=none; b=ZbdItHUPpawiPsq08zKEqw/sON0GCyDfWpA3hyWKVtl/CB8PtvBKJE1QAZTwOpzo6Ifa+J SG7xZv5sD9Hd8N4npxf4VDUVWz/QHyoL+VAZy7O3jPyTdJftMjAfg/WKbcnAViniJNsMjj R0Fn7+vln8BrbrtwOl6DkTEGiGqqjR3NU2Ub/9WpqG/4APyxmGuAC1LyMCDe2yG4y0p34n v3nO7Hco9/Q8uE3i5iELsBjgYmW56qkgajR2iSRT0c+VhjKnDwM4W86Vwlm62u3uFYAUIx xSVe/atObS1mvbcb3uvTUYp7+PKeHlx6anVXAb4++WrClaQ/sKnJW0hLZNhnOQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787248432; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cfBLI7yHkgk622qAR89y7dJuspwD7Q8FdRGSDzRHW3w=; b=dgTl5JsKMllpzicXW8GZZ0t7HCmM92PRZygkyr6g+iHNn43O03gQaVnNjshA+0KAYwf4/O WpgoRP1jn/zhzzsOhyVuNDYZJOYGttoFumwnLIL5l4xXRaZ5A69lMLSmLW98gsfWDhp0Md 1qAJX4aOEQChtJisKMs1DvHQWgfyHifXOE5ei2+Ye8AabXuj8o73iBTwVDEztVGIDPR8eG UD9/zqxKU69sA/+3Fy1ZlAxp2gYS7r1Hwy7yAXQtDZHO2Kxcrf/QvadWPCvVOm/VXy4Uop +HHE2byUxgxOioIG9OaBIhQcIn2t7Day5P/INQuaMIrOaggqMkUgPyBjwt/70Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hQrf76KvXzCBy for ; Thu, 20 Aug 2026 17:53:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4732d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 20 Aug 2026 17:53:51 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Mark Johnston From: Colin Percival Subject: git: 9c5f81332bdc - releng/14.5 - in_mcast: Fix uninitialized variable usage in inm_merge() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cperciva X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.5 X-Git-Reftype: branch X-Git-Commit: 9c5f81332bdc4e4a55ee54bd39e4d4d505097411 Auto-Submitted: auto-generated Date: Thu, 20 Aug 2026 17:53:51 +0000 Message-Id: <6a873f2f.4732d.3733e99a@gitrepo.freebsd.org> The branch releng/14.5 has been updated by cperciva: URL: https://cgit.FreeBSD.org/src/commit/?id=9c5f81332bdc4e4a55ee54bd39e4d4d505097411 commit 9c5f81332bdc4e4a55ee54bd39e4d4d505097411 Author: Mark Johnston AuthorDate: 2026-08-11 16:42:41 +0000 Commit: Colin Percival CommitDate: 2026-08-20 17:52:45 +0000 in_mcast: Fix uninitialized variable usage in inm_merge() When the first loop in inm_merge() hits an error, generally because it hit some limit on the number of source filters for a multicast group, inm_merge() tries to atomically roll back changes to the group source filter list. To roll back, it iterates over the global source filter list for the multicast group, starting at the last entry that we updated ("nims"). But, if we have not yet updated any entries, this variable is uninitialized. Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM doesn't visit any source filters in this case. All of the above applies to the v6 case. Approved by: re (cperciva) Reported by: Daniel Birtwhistle MFC after: 1 week Sponsored by: The FreeBSD Foundation (cherry picked from commit b9db5a5b16477863654f92ec653e8464528ef981) (cherry picked from commit 843ef8961512682f152266a6cec85de47c7b9396) --- sys/netinet/in_mcast.c | 1 + sys/netinet6/in6_mcast.c | 1 + 2 files changed, 2 insertions(+) diff --git a/sys/netinet/in_mcast.c b/sys/netinet/in_mcast.c index 4fd00bac3ae4..b379053706cb 100644 --- a/sys/netinet/in_mcast.c +++ b/sys/netinet/in_mcast.c @@ -1023,6 +1023,7 @@ inm_merge(struct in_multi *inm, /*const*/ struct in_mfilter *imf) * Maintain a count of source filters whose state was * actually modified by this operation. */ + nims = NULL; RB_FOREACH(ims, ip_msource_tree, &imf->imf_sources) { lims = (struct in_msource *)ims; if (lims->imsl_st[0] == imf->imf_st[0]) nsrc0++; diff --git a/sys/netinet6/in6_mcast.c b/sys/netinet6/in6_mcast.c index 4ec9f36cd9ac..0489e656555a 100644 --- a/sys/netinet6/in6_mcast.c +++ b/sys/netinet6/in6_mcast.c @@ -1039,6 +1039,7 @@ in6m_merge(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf) * Maintain a count of source filters whose state was * actually modified by this operation. */ + nims = NULL; RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) { lims = (struct in6_msource *)ims; if (lims->im6sl_st[0] == imf->im6f_st[0]) nsrc0++;