From nobody Wed Oct 14 16:02:55 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j4bZl48vmz6vmPk for ; Wed, 14 Oct 2026 16:02:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j4bZl2RKyz4Xvm for ; Wed, 14 Oct 2026 16:02:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993775; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SuTQlzbcVkKizRDB10dKyTlDJrrjMXHUSfIOIY/LeVk=; b=BYH0/QZmzqY/rJgAt9w6W9WXUhRsYF5RgcgHOTi/dB3p10bCgfdDl62XIS77PyKOmIz9Jt hAc1ceHd1vII5UXuquq+KHNgnQibNIb6mAyfSZKcXL3ZQT7oRgFdgu8jL+5H4M9f/3dZFF M2O4bamXim/Zz9OUzzUfvbUso4sh9WR2Fbdcl7hNLniN1dSCYhbwNU3uY3BcdpHKixCeoj YeGptL+jZ317Qw9ZUARzcfkkgx4LpMPdbGlHG8lGi/0VeQcgfWdcBnoxXnkUxmvwngfEco Ys26DWyFoLBPW0Og+Mrgq0do0n3QlJBlOfeFJmGP5WKOi5qWIOcu6HPIjAecOw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791993775; b=OlsrgSef7ReR2tQ7jwsT0KrYDG7UyT/vuG5xJ6kPb6UUFJObO8HdM6+K8wE+63NfhL99kU g/8EY7APMo7+//L7p/6rgATE5mpL7xQ6saIvU1s/9drUY3xhwCRsehfRaeQ8dryaXi/+Bv rdWK+OMQczFqV9qHUy1hon8kOUTMCEMnJSLOVZ81GWfENXee9e3fRFh9swrkOWFMs7W7kN ZAM5kyKl3Wctj57XU6e2aT7Q/s1HEkq7+un6aPzWeICPdplBJrSBthY8nKs8HBtFXnvx9j lkB5y50HEUeOHmLiW54msiIskC0efwmKX73neBH2km8bblPIezFxSQOojDZNaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993775; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SuTQlzbcVkKizRDB10dKyTlDJrrjMXHUSfIOIY/LeVk=; b=DHPQTogzbCIwgXvIrgpp4+tFYdzhmq6V6d3gWHUrBZymdgkWBT65ZRipCT4kitL3gNtg9Y /DnLBAj3kVeUrxdl1jES2ArLMw2nbSftqGBdm1XoBAy0mJmsJvDgtHLIe+pZNctqh4PeVa DjgKA+2U+yB8Hbk2G48TyBOZxbV1ZKqS9yxC3p9U7DtDtrG+iOuYzgPUB+doQupSNarjJa BdXtW4shg+FKza1qI9fPvXA1l0rqVpQ5eqbHYMaeOoRYuthkK8ZCYLe+OznKJdIEDaoat6 j09DlEnOxsY7G1erWJJnuXubw/bcRZZOcrTo938xjkir3nxnjctCs6+gD2YmfA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j4bZl1PvMz18FT for ; Wed, 14 Oct 2026 16:02:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 278cb by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 14 Oct 2026 16:02:55 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Michael Tuexen From: Mark Johnston Subject: git: 57818a298ee1 - stable/15 - tcp/rack: Fix a potential overflow in rack_update_pcm_ack() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 57818a298ee1b7e907df7759346f9f4a11370d63 Auto-Submitted: auto-generated Date: Wed, 14 Oct 2026 16:02:55 +0000 Message-Id: <6acfa7af.278cb.1e7a8337@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=57818a298ee1b7e907df7759346f9f4a11370d63 commit 57818a298ee1b7e907df7759346f9f4a11370d63 Author: Michael Tuexen AuthorDate: 2026-10-12 18:55:21 +0000 Commit: Mark Johnston CommitDate: 2026-10-14 16:00:47 +0000 tcp/rack: Fix a potential overflow in rack_update_pcm_ack() The RACK stack's path capacity measurement module maintains an array of samples, updated when the stack receives an ACK. The array grows as needed, but code which handles the expansion is susceptible to remotely triggerable overflow. This could lead to underallocation and a ~512KB out-of-bounds write. Fix this by bounding the sample array size. Approved by: so Security: FreeBSD-SA-26:70.tcp Security: CVE-2026-101307 Reviewed by: glebius, markj Reported by: Nozomi Networks Security Research --- sys/netinet/tcp_stacks/rack_pcm.c | 17 +++++++++++------ sys/netinet/tcp_stacks/tcp_rack.h | 6 ++++-- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/sys/netinet/tcp_stacks/rack_pcm.c b/sys/netinet/tcp_stacks/rack_pcm.c index 1a51097f627c..66297006000e 100644 --- a/sys/netinet/tcp_stacks/rack_pcm.c +++ b/sys/netinet/tcp_stacks/rack_pcm.c @@ -196,17 +196,22 @@ rack_update_pcm_ack(struct tcp_rack *rack, int was_cumack, uint32_t start, uint3 } else { /* Need to expand the array */ struct rack_pcm_stats *n; - uint16_t new_cnt; + size_t new_cnt; - new_cnt = rack->r_ctl.pcm_i.cnt_alloc * 2; - sz = (sizeof(struct rack_pcm_stats) * new_cnt); - n = malloc(sz,M_TCPPCM, M_NOWAIT); - if (n == NULL) { - /* We are dead, no memory */ + new_cnt = (size_t)rack->r_ctl.pcm_i.cnt_alloc * 2; + if (new_cnt > RACK_MAX_PCM_ARRAY) { + /* Too many entries required. */ +stop_measurement: rack->pcm_in_progress = 0; rack->r_ctl.pcm_i.cnt = 0; return; } + sz = (sizeof(struct rack_pcm_stats) * new_cnt); + n = malloc(sz, M_TCPPCM, M_NOWAIT); + if (n == NULL) { + /* We are dead, no memory. */ + goto stop_measurement; + } sz = (sizeof(struct rack_pcm_stats) * rack->r_ctl.pcm_i.cnt_alloc); memcpy(n, rack->r_ctl.pcm_s, sz); free(rack->r_ctl.pcm_s, M_TCPPCM); diff --git a/sys/netinet/tcp_stacks/tcp_rack.h b/sys/netinet/tcp_stacks/tcp_rack.h index cac17d9aeb50..4d9e516a8b98 100644 --- a/sys/netinet/tcp_stacks/tcp_rack.h +++ b/sys/netinet/tcp_stacks/tcp_rack.h @@ -362,9 +362,11 @@ struct rack_pcm_info { uint16_t cnt; /* Maximum acks present */ uint16_t cnt_alloc; +#define RACK_DEFAULT_PCM_ARRAY 16 +#define RACK_MAX_PCM_ARRAY 1024 }; - -#define RACK_DEFAULT_PCM_ARRAY 16 +_Static_assert(RACK_MAX_PCM_ARRAY <= UINT16_MAX, + "RACK_MAX_PCM_ARRAY must fit in 16 bits"); struct rack_pcm_stats { uint32_t sseq;