From nobody Wed Oct 14 16:04:34 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j4bcg3cT2z6vmRR for ; Wed, 14 Oct 2026 16:04:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j4bcg03K6z4bdr for ; Wed, 14 Oct 2026 16:04:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993875; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PHMTWo5ED28YZRx6FCzDfkmiXq3kWK23xwfw74zh1LI=; b=tQEw3XgEjULztLGjETXTHUB/KenIXM1YKbfhwaAGCYsNRuAbjF9xH4kR3ZDBSwol9nHc/T xDu2PMY9za/m1m1lIrVqmAc4EKfZoeD1upAFmh+6v5QF3CoYz2x2NZbyH5oWZweXOhILKh 2SPFz6UzT587o6CTBwv0vD9pME8/FhmIg0/ie+EOX++c/33ag4PCbOZzRhMP93ydiZo446 ESIMVFYjas0b+URyz/n2w2cVaXcLZ8ILNZCYREz2vbnc6IwSQTEWz/6E7SDzfy8utGcxwe 55A2PtjKPMyQVnypzBAlM4qc0wH8JWCWKpQ6WbT+Ewud8IS0czTym/Mcy2wtcA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791993875; b=sO0XU1G/hxWQKl/M+JWNPhMx1xRoe0BfB3UBpP5mm5mGQddUs9ogE9PM4FoLcDZFZ+sfs4 vfuCvgrBD4540FTYMlLarptxC2KDiq+TsY6dYA3/d2bmgC4nmAtX5fmxic6LHi7JoWQiJH O5pNUEJtP6kOUC10C5zgBjPNeArFXGgSOvgTqnv/11wXhsIoPfMsHFXC+LqOPaKNypgvPs uWJem5Ls1RV/yOKXj2qPXm67ltmHkHLr+oMrBJPeTn1iAuMke0lrCaaH+hSs0ufvgHyiHY R1qPjE/H8ISz9HoLF0027lEAoNH6QwbqnxQPtqqcamp4bYUkvAL69xl2Gw6cTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993875; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=PHMTWo5ED28YZRx6FCzDfkmiXq3kWK23xwfw74zh1LI=; b=DITUJqq+wVz8Mhz6UEcLomzp+gOfv2RzvJ8djEuna/3XQ1vhJW57wFdbAlSCHLEIiV3HIZ aoCOyb8BC0NYxL9mTtpYETz8tJOGq3HYdYg56p+7NLwqrJqbE1+Gi5zIuMfz5pI85cynZf H8IoNVxLJsTU8YDE9MgJ2YLDMYzYQL64bUkg4Ob/6+l/nfPhyePxifgRFtG8FczkCmZZRg XXCOTgxvDvtv72gQeG/+NISXkbGrPUQ+DzGToJLFuRrXuTLGGZqnLxPl7f1cRKrGwCkX2R oa1nRB++mfSNLvy9acE7RCP4NCwOYScvq07gOH71n4KSwGcpAaxar6OURWf57A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j4bcf6D4fz189n for ; Wed, 14 Oct 2026 16:04:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 26377 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 14 Oct 2026 16:04:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Michael Tuexen From: Mark Johnston Subject: git: 5dd20a06fe9e - releng/15.1 - tcp/rack: Fix a potential overflow in rack_update_pcm_ack() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.1 X-Git-Reftype: branch X-Git-Commit: 5dd20a06fe9ebd45c26753b2eeca801f173b4643 Auto-Submitted: auto-generated Date: Wed, 14 Oct 2026 16:04:34 +0000 Message-Id: <6acfa812.26377.56d35bec@gitrepo.freebsd.org> The branch releng/15.1 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=5dd20a06fe9ebd45c26753b2eeca801f173b4643 commit 5dd20a06fe9ebd45c26753b2eeca801f173b4643 Author: Michael Tuexen AuthorDate: 2026-10-12 18:55:21 +0000 Commit: Mark Johnston CommitDate: 2026-10-13 17:32:51 +0000 tcp/rack: Fix a potential overflow in rack_update_pcm_ack() The RACK stack's path capacity measurement module maintains an array of samples, updated when the stack receives an ACK. The array grows as needed, but code which handles the expansion is susceptible to remotely triggerable overflow. This could lead to underallocation and a ~512KB out-of-bounds write. Fix this by bounding the sample array size. Approved by: so Security: FreeBSD-SA-26:70.tcp Security: CVE-2026-101307 Reviewed by: glebius, markj Reported by: Nozomi Networks Security Research --- sys/netinet/tcp_stacks/rack_pcm.c | 17 +++++++++++------ sys/netinet/tcp_stacks/tcp_rack.h | 6 ++++-- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/sys/netinet/tcp_stacks/rack_pcm.c b/sys/netinet/tcp_stacks/rack_pcm.c index 1a51097f627c..66297006000e 100644 --- a/sys/netinet/tcp_stacks/rack_pcm.c +++ b/sys/netinet/tcp_stacks/rack_pcm.c @@ -196,17 +196,22 @@ rack_update_pcm_ack(struct tcp_rack *rack, int was_cumack, uint32_t start, uint3 } else { /* Need to expand the array */ struct rack_pcm_stats *n; - uint16_t new_cnt; + size_t new_cnt; - new_cnt = rack->r_ctl.pcm_i.cnt_alloc * 2; - sz = (sizeof(struct rack_pcm_stats) * new_cnt); - n = malloc(sz,M_TCPPCM, M_NOWAIT); - if (n == NULL) { - /* We are dead, no memory */ + new_cnt = (size_t)rack->r_ctl.pcm_i.cnt_alloc * 2; + if (new_cnt > RACK_MAX_PCM_ARRAY) { + /* Too many entries required. */ +stop_measurement: rack->pcm_in_progress = 0; rack->r_ctl.pcm_i.cnt = 0; return; } + sz = (sizeof(struct rack_pcm_stats) * new_cnt); + n = malloc(sz, M_TCPPCM, M_NOWAIT); + if (n == NULL) { + /* We are dead, no memory. */ + goto stop_measurement; + } sz = (sizeof(struct rack_pcm_stats) * rack->r_ctl.pcm_i.cnt_alloc); memcpy(n, rack->r_ctl.pcm_s, sz); free(rack->r_ctl.pcm_s, M_TCPPCM); diff --git a/sys/netinet/tcp_stacks/tcp_rack.h b/sys/netinet/tcp_stacks/tcp_rack.h index cac17d9aeb50..4d9e516a8b98 100644 --- a/sys/netinet/tcp_stacks/tcp_rack.h +++ b/sys/netinet/tcp_stacks/tcp_rack.h @@ -362,9 +362,11 @@ struct rack_pcm_info { uint16_t cnt; /* Maximum acks present */ uint16_t cnt_alloc; +#define RACK_DEFAULT_PCM_ARRAY 16 +#define RACK_MAX_PCM_ARRAY 1024 }; - -#define RACK_DEFAULT_PCM_ARRAY 16 +_Static_assert(RACK_MAX_PCM_ARRAY <= UINT16_MAX, + "RACK_MAX_PCM_ARRAY must fit in 16 bits"); struct rack_pcm_stats { uint32_t sseq;