From nobody Mon Jun 15 15:54:41 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gfF760gwLz6hXg5 for ; Mon, 15 Jun 2026 15:54:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gfF7600VNz3wJv for ; Mon, 15 Jun 2026 15:54:42 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781538882; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=liV4bOT0k7QildVrMO+EQDajqyA8bdrHbQgQFD92rsg=; b=efVuNZAhlbwtaYZ1qotoCqSdHyPtMxaNCybs/KRB7xRig5pr+ud/HkjPvYM47rvn3sUEPU l2m09UMMWI11yL1sgFgl7Q7J3kQs9vq5M/J0ryw2sGNRiRVjb7BMGh1l7r+bfCSNmMwTF8 7CPEtcc4ZeNZdRqAECPJVSBOuNL4e84y0K6xqoGdPuUTIrShRbWS91Ki90k1wpT7Q1elUk 66/cVDTQPhtby5oBUlxCPgr5/+CpsBjbDgJO358VFf7wm8lDfX0ee/yKMB7FeT5ZJgWVnN gG6DRzNfKEbUmJU2nyscy4xxbLIBid8N42W462F7Lw2gFoyHLDX/Sape2kLFzw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781538882; a=rsa-sha256; cv=none; b=jWyrlZ3o6sChmQos2aBb3o7ombR974Zy5/y3e9VcaWKX5+kRQIRsNPljd+P77kSdawO1mT PCSTYSHRwLWSbI1utlyjup6cVbBLK6pc+qbO7vEuYDZX+ysXv6VlLORR5ik1gPnXf491pU oOxwYsP3q+R1m6n80OrM/7jN4tpiEP5s8seO2FWC78E7dBWiq8M8VuKLlH5dSgEzgsajaI zyWV2XWbuYiBcllycMPvu+r8QLc26CEhy/y9PHJaPh9eWPjIfaIWajElXja5695tk4l8jS hzbnGLLVoaylv0HwsAW6HAB0RQXaTuGK4RzjSSXO9H1r3utm0HmuwgywfQlluA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781538882; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=liV4bOT0k7QildVrMO+EQDajqyA8bdrHbQgQFD92rsg=; b=RJn1GXAG8VvegzngEdFBRpR35fNI+pLvB6m/JeQS5vygjUEShpipY9EPjxEGu1gGBx2lId mhwP6pLvCMvGq27885VBY8WWr76OgEvleMh22dt/8SvRC/VYihSPGRZ2W0lL7yYGnzTr42 p6SnkV0ntsFCJC0bCNAZkCftuPJhxPHzrVtUCOUTtmZK02Xt3t/iWUc5jfJtboDB5WE8L0 6UBHBIhKRreBJl5a9w7W72mWApzLwzYH4uMOu711abtB5KXHmnGcizbvJjyJju6jK915dm sG3t4yqHlgzdwB28CTbSCRlZpJmE4LWkwL5r4eX9lRVmeW6FLxb7PnyAUuLfYQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gfF756X49z11vT for ; Mon, 15 Jun 2026 15:54:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 40f75 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 15 Jun 2026 15:54:41 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: fc7993cf2d6d - main - rpcsec_tls: Avoid a socket reference underflow in rpctls_server() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: fc7993cf2d6ddba9f94683565838bf8fabc0145c Auto-Submitted: auto-generated Date: Mon, 15 Jun 2026 15:54:41 +0000 Message-Id: <6a302041.40f75.510b45cf@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=fc7993cf2d6ddba9f94683565838bf8fabc0145c commit fc7993cf2d6ddba9f94683565838bf8fabc0145c Author: Mark Johnston AuthorDate: 2026-06-15 15:52:24 +0000 Commit: Mark Johnston CommitDate: 2026-06-15 15:54:30 +0000 rpcsec_tls: Avoid a socket reference underflow in rpctls_server() The upcall_sockets tree owns a ref on any resident socket. When a socket is removed after a TLS handshake failure, rpctls_rpc_failed() thus calls soclose(). rpctls_server() does not acquire an extra ref to compensate for this. So, if the upcall fails, e.g., because rpc.tlsservd is not running, we'll call soclose() to drop the reference, but this effectively releases the xprt layer's reference. Fix the problem by explicitly acquiring a socket reference when adding a socket to the upcall tree. PR: 289734 Reviewed by: rmacklem, glebius MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57555 --- sys/rpc/rpcsec_tls/rpctls_impl.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/sys/rpc/rpcsec_tls/rpctls_impl.c b/sys/rpc/rpcsec_tls/rpctls_impl.c index e1b80217263f..621f6bcac3e4 100644 --- a/sys/rpc/rpcsec_tls/rpctls_impl.c +++ b/sys/rpc/rpcsec_tls/rpctls_impl.c @@ -190,7 +190,6 @@ sys_rpctls_syscall(struct thread *td, struct rpctls_syscall_args *uap) CURVNET_RESTORE(); return (error); } - soref(ups.so); if (ups.server) { /* * Once this file descriptor is associated @@ -277,6 +276,7 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, if (stat != RPC_SUCCESS) return (RPC_SYSTEMERROR); + soref(so); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -294,9 +294,16 @@ rpctls_connect(CLIENT *newclient, char *certname, struct socket *so, stat = rpctlscd_connect_2(&arg, &res, rpctls_connect_handle); if (stat == RPC_SUCCESS) *reterr = res.reterr; - else + else { rpctls_rpc_failed(&ups, so); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + CLNT_CONTROL(newclient, CLSET_TLS, &(int){RPCTLS_INHANDSHAKE}); + } + /* Unblock reception. */ CLNT_CONTROL(newclient, CLSET_BLOCKRCV, &(int){0}); @@ -388,6 +395,7 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, uint32_t *gidv; int i; + soref(xprt->xp_socket); mtx_lock(&rpctls_lock); RB_INSERT(upsock_t, &upcall_sockets, &ups); mtx_unlock(&rpctls_lock); @@ -407,9 +415,18 @@ rpctls_server(SVCXPRT *xprt, uint32_t *flags, uid_t *uid, int *ngrps, for (i = 0; i < *ngrps; i++) *gidp++ = *gidv++; } - } else + } else { rpctls_rpc_failed(&ups, xprt->xp_socket); + /* + * The socket was closed, make sure the krpc code doesn't close + * it a second time. + */ + sx_xlock(&ups.xp->xp_lock); + ups.xp->xp_tls = RPCTLS_FLAGS_HANDSHFAIL; + sx_xunlock(&ups.xp->xp_lock); + } + mem_free(res.gid.gid_val, 0); #ifdef INVARIANTS