git: 65e2c2279b62 - stable/15 - in_mcast: Fix uninitialized variable usage in inm_merge()

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=65e2c2279b62dc4107f0a02b0570d35c9203d96f

commit 65e2c2279b62dc4107f0a02b0570d35c9203d96f
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-08-11 16:42:41 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-08-24 15:17:54 +0000

    in_mcast: Fix uninitialized variable usage in inm_merge()
    
    When the first loop in inm_merge() hits an error, generally because it
    hit some limit on the number of source filters for a multicast group,
    inm_merge() tries to atomically roll back changes to the group source
    filter list.
    
    To roll back, it iterates over the global source filter list for the
    multicast group, starting at the last entry that we updated ("nims").
    But, if we have not yet updated any entries, this variable is
    uninitialized.  Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
    doesn't visit any source filters in this case.
    
    All of the above applies to the v6 case.
    
    Reported by:    Daniel Birtwhistle
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    
    (cherry picked from commit b9db5a5b16477863654f92ec653e8464528ef981)
---
 sys/netinet/in_mcast.c   | 1 +
 sys/netinet6/in6_mcast.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/sys/netinet/in_mcast.c b/sys/netinet/in_mcast.c
index b5636c29daeb..032636417a0c 100644
--- a/sys/netinet/in_mcast.c
+++ b/sys/netinet/in_mcast.c
@@ -1023,6 +1023,7 @@ inm_merge(struct in_multi *inm, /*const*/ struct in_mfilter *imf)
 	 * Maintain a count of source filters whose state was
 	 * actually modified by this operation.
 	 */
+	nims = NULL;
 	RB_FOREACH(ims, ip_msource_tree, &imf->imf_sources) {
 		lims = (struct in_msource *)ims;
 		if (lims->imsl_st[0] == imf->imf_st[0]) nsrc0++;
diff --git a/sys/netinet6/in6_mcast.c b/sys/netinet6/in6_mcast.c
index 4ec9f36cd9ac..0489e656555a 100644
--- a/sys/netinet6/in6_mcast.c
+++ b/sys/netinet6/in6_mcast.c
@@ -1039,6 +1039,7 @@ in6m_merge(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf)
 	 * Maintain a count of source filters whose state was
 	 * actually modified by this operation.
 	 */
+	nims = NULL;
 	RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) {
 		lims = (struct in6_msource *)ims;
 		if (lims->im6sl_st[0] == imf->im6f_st[0]) nsrc0++;