From nobody Tue Oct 20 07:24:35 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j83nv4YVcz6wXs0 for ; Tue, 20 Oct 2026 07:24:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j83nv29x0z3NWS for ; Tue, 20 Oct 2026 07:24:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792481075; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UTfUuo7fvNjCO/dP7hvhC4R1OGwmH7DCefVlZDnM5n8=; b=uUmB3cloAcXgbgv52cAzrcrh7BOOR18L5G2pRmRnCODBPr5rt3I+6Y8YE3QFqsPZXOPUgr 9n2Wl56y1ZN3mdXxWMKQSfRNpaXTEsqC0176Bc8I2Kci+86AsYifsUj4KRE87YB9cygtRQ mz3S3Af2UkKUj4GvRFXflKG/0Ck7uWbH9E1DNsx0AL7tuobRfXscP/YXQse3i2kgEeyyQw UjDD96Y7QngfiHG8JuKSMn+M1FyTHLeOizDfF+goKzxuGdB+kVQdFEbP3DG37sZeqZLOMU y5QvlxMUDlHaMiSltsC+y617RZDcFKYLqGtpEGcGtyNmw0UAZP0JWZF8hI3Lww== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792481075; b=LFEl7eV3s9kBHoxrHqIxgYWcohGNCxGo/cVT3XVr9y3j1RAl9EV7mZRlW1Zd/sYlprcPPz TEVifgTcLqEChB+6ZUwbWxj2BTc/9tjU8tX/fPR/SmPk/L6jjYqoOihJVAtKIvVTzJGvXW GSWnX7se0K6ITztPAg6rK/lh7zp8KblRVyT0HMymmW0O9rulYjUztJNCxZYoewfJRpuqRL lL9I3IdQvFJLva1mbi73EgsoEgUlkV6pk6P2COAFT6mwSUCdjv3ncRKfmoKWzge0yP9M3z mZkICwKHGEXIDQ/AmxtAoEg2rc3M5a08LXYiaW07WhBxyybQiE5uwwYyobVJiw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792481075; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UTfUuo7fvNjCO/dP7hvhC4R1OGwmH7DCefVlZDnM5n8=; b=Q/5VXZHMcP05T+eYDiV+E5xhgHfdnaoOmk18WoO1Xyg/MdtofhqMPCRxBYfq5fmvBbNQcu 04MmBwG5Q9Oyt5b7UMc1HC+prnnkEjwyBiuvzYf47KwU0UeVr1WtXWQjSyWDiTKNtmwz41 JG97hWi2UzIHdADtjOiq+rQtS+GIjghx55Fo06lHZP0cZ/JMtqvc85lF1hR3M0BIY5XGBp VEPxpqHJ9a3Yi7ab6F3ART7waXHVsT2NHfEvjUmTGKVNrlgamDLwPRJgukod2zF44SwBCm lQglYDjvxLA4hesxpH3oxkdy8v9C8TtDhN1F08i0UyW7/jh9EpyOdExga7TULw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j83nv17kkzxfw for ; Tue, 20 Oct 2026 07:24:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3cc52 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 20 Oct 2026 07:24:35 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: a2a0e5e0e38f - stable/15 - pf: check extension header length. List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a2a0e5e0e38fa9791f2966e0430b8754530d6b72 Auto-Submitted: auto-generated Date: Tue, 20 Oct 2026 07:24:35 +0000 Message-Id: <6ad71733.3cc52.6af65ee6@gitrepo.freebsd.org> The branch stable/15 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=a2a0e5e0e38fa9791f2966e0430b8754530d6b72 commit a2a0e5e0e38fa9791f2966e0430b8754530d6b72 Author: Kristof Provost AuthorDate: 2026-10-12 12:25:07 +0000 Commit: Kristof Provost CommitDate: 2026-10-20 07:22:50 +0000 pf: check extension header length. pf_walk_header6() advances the packet offset for each IPv6 extension header. It was not checked that this does not exceed the packet length if no next header was processed. When used with af-to rules, this could trigger a panic: m_copydata: null mbuf. from Acts1631; OK henning@ sashan@ MFC after: 1 week Obtained from: OpenBSD, bluhm , 6d56112588 Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit ccb19b359aae4b7e7315ad61d33d9a35d85849d1) --- sys/netpfil/pf/pf.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 4a4dd209b7c2..ea081fa90b34 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -10232,7 +10232,7 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason) struct ip6_ext ext; struct icmp6_hdr icmp6; struct ip6_rthdr rthdr; - uint32_t end; + uint32_t end, extlen; int hdr_cnt, fraghdr_cnt = 0, rthdr_cnt = 0; pd->off += sizeof(struct ip6_hdr); @@ -10343,9 +10343,20 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason) return (PF_DROP); } if (pd->proto == IPPROTO_AH) - pd->off += (ext.ip6e_len + 2) * 4; + extlen = (ext.ip6e_len + 2) * 4; else - pd->off += (ext.ip6e_len + 1) * 8; + extlen = (ext.ip6e_len + 1) * 8; + if (end < pd->off + extlen) { + if (pd->fragoff != 0) { + pd->off = pd->fragoff; + pd->proto = IPPROTO_FRAGMENT; + return (PF_PASS); + } + DPFPRINTF(PF_DEBUG_MISC, "IPv6 long exthdr"); + REASON_SET(reason, PFRES_SHORT); + return (PF_DROP); + } + pd->off += extlen; pd->proto = ext.ip6e_nxt; break; case IPPROTO_ICMPV6: