From nobody Fri Oct 30 17:50:48 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jGTCr2XQYz6xHZ4 for ; Fri, 30 Oct 2026 17:50:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jGTCr1crhz4k13 for ; Fri, 30 Oct 2026 17:50:48 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793382648; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4fAKFz+Vy4MIRCHp3GmVCZtGsCdPzVHN3E9t6XTshYw=; b=S4YrswB8aPN0f9bvpDoCGk5khgkDzt0DA1C+YsdcQ7LeUMXf8zwpqXPDis00AVh3CV3dEZ vxDAksO5nvLhb7l+njD93KJMip+G8CU9fd8SULvMWmJfSTe1NiMARzIuPG/yPeckSTojBH idYk2O8cA+S5OnfT8sClKTXjLAlj0qSGrsbzUXird/X7a112hqx80RDDI77E6C/ThxVu+r wzBIlBGqzIuSMIfgSY42pzlrmBnbnH96yIRC19k64EF0RYOBuPxhMsTdYsIHbjTW/N+2Xc KLKecc4Dj/KFEiR2S/dkBtcymcIMN67m3AKVonlORWPkXhB0yC8HnG0sRPqYFA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793382648; b=AI45v1kFZl6V9m7I2kBE1+gQ/j8TNBZs5gsdCzZnYKAwLK0PS/1iIUPJC+u/Et5GtEU1fb WjyNcP5FunWUBZiHtZ7G96jHy3y3LoyWSC4sWJeQeUA75ziPM2VZK6p6X/m11f1cm+PTTv KzTbvoE3/hdIbDRFMWl1Dy7GrnAZ6GtN8WPejicpBlAMapT848qhEwIoeHajuRQsSnGdWo XUVoQxdDpN1yZh6qiN7IqB43tMK9fnsYg0c/Hw70G/vNzBEfuEKCIfcHQ/BW3yjfhaphRb O3Ylh/2Y/ZhQyBFS5KwAR3D5FPtZk/621PAM62Te2Am/U6SziqugXEMC0dYH5Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793382648; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4fAKFz+Vy4MIRCHp3GmVCZtGsCdPzVHN3E9t6XTshYw=; b=tgPd1OPyMTKmm8+Kfswar+HBhGdH6ZnM/tRc5OOXyFROi+5V9Hm8uiGiYtbxhbecOAZ883 57vvLfDoZp20iuhE3gKGEqDtO4azwh6/b1b4G1C+e33PzmmBQg4dogLLa1iTzmTvLj4484 +Mjq1A7z26RNlIi8yQaBwJ56NIf/xgw8XLHJhiq2PIsOywvDijwODzumdMfklt9hJ7P1U6 awwLMvQlN9sIE7vciB2wSF4nU50bunUhBExbIMVYf/GdPgS0tzRtST6mytp2XVhHeJ5udi oPfZiSHEILA/US8ppdmjVIuvOEvsKXtzBPGI3dCTyZ0hDVf7OLyoL/DSbrTYCw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jGTCr1BZvzdlv for ; Fri, 30 Oct 2026 17:50:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 42391 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 30 Oct 2026 17:50:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Teddy Engel From: Kevin Bowling Subject: git: df8a63fbae20 - stable/15 - nat64lsn: Fix type confusion panic when using wrong NAT64 instance type List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kbowling X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: df8a63fbae20815a66fbafed00e533cd8f10468a Auto-Submitted: auto-generated Date: Fri, 30 Oct 2026 17:50:48 +0000 Message-Id: <6ae4d8f8.42391.3a1d489a@gitrepo.freebsd.org> The branch stable/15 has been updated by kbowling: URL: https://cgit.FreeBSD.org/src/commit/?id=df8a63fbae20815a66fbafed00e533cd8f10468a commit df8a63fbae20815a66fbafed00e533cd8f10468a Author: Teddy Engel AuthorDate: 2026-06-01 16:42:56 +0000 Commit: Kevin Bowling CommitDate: 2026-10-30 17:50:14 +0000 nat64lsn: Fix type confusion panic when using wrong NAT64 instance type When an ipfw rule references a NAT64 instance by name using 'nat64lsn', the kernel looks up the instance in the shared srvstate[] array without verifying the instance type. If the named instance is actually a nat64clat or nat64stl instance (created with 'nat64clat' or 'nat64stl'), the code incorrectly casts the instance to nat64lsn_instance and dereferences the ->cfg pointer, which causes a kernel panic. The root cause is that all NAT64 instance types share the same srvstate[] array but have different struct layouts. For nat64lsn_instance, the field after 'no' is a pointer to nat64lsn_cfg. For nat64clat_cfg, the same offset contains an embedded nat64_config struct. Fix by adding a type check after NAT64_LOOKUP() to verify that the instance's etlv matches IPFW_TLV_NAT64LSN_NAME before proceeding. If the type doesn't match, return IP_FW_DENY to reject the packet safely rather than crashing. Signed-off-by: Teddy Engel PR: 292023 Reported by: pouria Reviewed by: ae Pull-Request: https://github.com/freebsd/freebsd-src/pull/2249 (cherry picked from commit ea4888e63f6ac89c38982ffee693f89a5927e9c9) --- sys/netpfil/ipfw/nat64/nat64lsn.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sys/netpfil/ipfw/nat64/nat64lsn.c b/sys/netpfil/ipfw/nat64/nat64lsn.c index 5d2ee7ee3b34..2278a6b602ee 100644 --- a/sys/netpfil/ipfw/nat64/nat64lsn.c +++ b/sys/netpfil/ipfw/nat64/nat64lsn.c @@ -1731,7 +1731,8 @@ ipfw_nat64lsn(struct ip_fw_chain *ch, struct ip_fw_args *args, if (cmd->opcode != O_EXTERNAL_ACTION || insntod(cmd, kidx)->kidx != V_nat64lsn_eid || icmd->opcode != O_EXTERNAL_INSTANCE || - (i = NAT64_LOOKUP(ch, icmd)) == NULL) + (i = NAT64_LOOKUP(ch, icmd)) == NULL || + i->no.etlv != IPFW_TLV_NAT64LSN_NAME) return (IP_FW_DENY); *done = 1; /* terminate the search */