From nobody Wed Oct 28 16:00:48 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jFBsx35Rcz6xgM4 for ; Wed, 28 Oct 2026 16:00:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jFBsx2RChz4pJW for ; Wed, 28 Oct 2026 16:00:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793203253; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KOMfCBaUTYbUs5AsrjQ7h1uYvsd0SA/qavMjsKV7NPo=; b=Ix2SOy8WtEA5UiR8Xf3pFfXkDimRDnbGD7puP5XMph0G9A+SsAjzcFqRq6AkHiermU67TU rKBpZDnJFJ7Q7YVJyDLQ3dtyD/UKu/xRejBDei9vACPKl+z/2+SQycSXQEfa2OnVsC0PCS f6GOMwqHy5F6yRcMYescSjJjTBKMSDLlsW3Fa+fykkG7aDuYbiqUzuQa1Fc+sYiO6A83ls XKbAH7Ey2EwbqpZeC+1LERaFF1pJSqEWeS5NcIFb8kLRuW1lOzmRGxhPVhSGn1eHSrdd8i nXzQ1vXrXWCVmsSCWXveWkD02coYm0x+1o7AyGFFxgqHV4GF32jbeLTVWPhe3Q== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793203253; b=uRefLwBLHZCcmwKQ03sj9EZWa4NMAkYFNQCw3pbdm3lqnthw2NmeqmGKzAUx0HUkGgkWbA Ss1+raYf8gdoWAeYbVkbybBUGFe7J+iw9ShnTvi6AnNfT+Y2z1gx3KhZGNhkm0Cl2xpc5Q SlimvaPPnQkcuwH4gph/K+le6JqDK7fKXbQz/VAXHhuZS7V9BhabVyxwiU039qefBKed1I 5D26d3HA/0FfIMF2n+RlpGBTjR5o2G50OAqRJlj5XXksHk3YLT7Aktcs0P27rPPD5XwWuI mlQikX0eT9EzjxIkzrqN7jsnsgMLhPxwKNG8LUXws0207PQmWPYB9o0dchz5ng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793203253; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KOMfCBaUTYbUs5AsrjQ7h1uYvsd0SA/qavMjsKV7NPo=; b=ofyTAnb6cDyqCR6AALQam2ka6Gk1tSzV+E15quhmuJLqeP0/5ChotULnwXAoLoFvdoFjK8 0Q3iRohSKg6TFdmf3kdYBU+tYcz6krg4MYUTebkTaKwCd9YUDxxUhNeFess/rlQA1jRNRm 6gY0/7F5NZunuXyMd7zcyo34+ieh43XMxh5luH1WdvZRptGfsKmQn0/q8t9b+nqaf8FKBr G5LQYVAk7bBNAXvrqenzCxhfg2ejz8hNwjNoA6jgf3jWeWxCrCL9eWjDVhJB2PQCbwaR6k WD9yR2jX3xIFs076DZjWwca0s6L84n0eUbA961SatE6j8e4baaNDrWQxxq8NkA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jFBsx25t0z1DG9 for ; Wed, 28 Oct 2026 16:00:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 304ca by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 28 Oct 2026 16:00:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: R. Christian McDonald Subject: git: 110801814911 - main - pf: Clear only the part of the packet descriptor that is read first List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 11080181491144b9cad726bb6e84d87fa05a681e Auto-Submitted: auto-generated Date: Wed, 28 Oct 2026 16:00:48 +0000 Message-Id: <6ae21c30.304ca.59bc78ff@gitrepo.freebsd.org> The branch main has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=11080181491144b9cad726bb6e84d87fa05a681e commit 11080181491144b9cad726bb6e84d87fa05a681e Author: R. Christian McDonald AuthorDate: 2026-10-28 16:00:03 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-28 16:00:03 +0000 pf: Clear only the part of the packet descriptor that is read first pf_init_pdesc() cleared the whole structure, 336 bytes on amd64, for every packet and twice for a forwarded one. kif, m, pf_mtag, act and the SCTP job list are set before they are read, so move them to the end and clear only the 240 bytes before them. On amd64 that also stays below the 256 bytes from which memset() switches to rep stosb. Reviewed by: kp Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D60948 --- sys/net/pfvar.h | 14 +++++++++----- sys/netpfil/pf/pf.c | 4 +++- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 6c7c7d364ba2..5b4d87a22301 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -1950,9 +1950,6 @@ struct pf_pdesc { struct pf_addr nsaddr; /* src address after NAT */ struct pf_addr ndaddr; /* dst address after NAT */ - struct pfi_kkif *kif; /* incomming interface */ - struct mbuf *m; - struct pf_addr *src; /* src address */ struct pf_addr *dst; /* dst address */ struct pf_addr osrc; @@ -1964,8 +1961,6 @@ struct pf_pdesc { u_int16_t odport; u_int16_t nsport; /* src port after NAT */ u_int16_t ndport; /* dst port after NAT */ - struct pf_mtag *pf_mtag; - struct pf_rule_actions act; u_int32_t off; /* protocol header offset */ bool df; /* IPv4 Don't fragment flag. */ @@ -2011,6 +2006,15 @@ struct pf_pdesc { u_int16_t sctp_dummy_sum; struct pf_krule *related_rule; + /* + * pf_init_pdesc() zeroes the members above this point only; those + * below are set before they are read. + */ +#define pd_endzero kif + struct pfi_kkif *kif; /* incoming interface */ + struct mbuf *m; + struct pf_mtag *pf_mtag; + struct pf_rule_actions act; struct pf_sctp_multihome_jobs sctp_multihome_jobs; }; diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 5961039bbb87..94985f47677c 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -11279,7 +11279,7 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason) static void pf_init_pdesc(struct pf_pdesc *pd, struct mbuf *m) { - memset(pd, 0, sizeof(*pd)); + memset(pd, 0, offsetof(struct pf_pdesc, pd_endzero)); pd->pf_mtag = pf_find_mtag(m); pd->m = m; } @@ -11301,6 +11301,8 @@ pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0, TAILQ_INIT(&pd->sctp_multihome_jobs); if (default_actions != NULL) memcpy(&pd->act, default_actions, sizeof(pd->act)); + else + memset(&pd->act, 0, sizeof(pd->act)); if (pd->pf_mtag && pd->pf_mtag->dnpipe) { pd->act.dnpipe = pd->pf_mtag->dnpipe;