From nobody Mon Aug 24 16:29:55 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTGbR6qlHz6pbY0 for ; Mon, 24 Aug 2026 16:29:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTGbR4wVVz41G6 for ; Mon, 24 Aug 2026 16:29:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787588995; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ud7Ydzkg4sHIKj+GwuzZq6P3iLWSqtLCs7Kt2F/MJKQ=; b=N0N0JgucFC42OVsulxC4i5eUEVRSGEE1/lAHp7y0p3afRFx6GTX57ZLZG/OyoKKYx5EOoN L3Yf0vObUbTEp4NWfyA58GKy4xvOvliH+Zfb15sgX/4yvXpf6TGrKLK+yHxl/S/mE1kCXs gdVCrhZNixaE+ZwKIwr3HUlgxlM2NhYZcEi034rI0T4+SAQEM2z+YcYHDjek0k3kOSWoYz zZOlDNLKNA1LFhrKTrMy6QhUpfIIKtNqekDbzjWWoWdm7BM2no/QKMt59llL3BJ2sNQ+Xz e8B6WkqRgZ6QA5MfgPQW4IHsNSZdv00quVmLiZXEnBfi66e56ZExu1tb/BItCQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787588995; a=rsa-sha256; cv=none; b=nqHQCBCugPr1aCyq1tcEqCchVNgRix2UsHG+FYBJfwN7doExtr2ZeDYVT+h+1v6bITjJrn kM9ki1xJMTSYsgE9FVl/qv0WdJJZ8jj1HV4x4V6BOgJzm/VSPorOeWiccgfkl14rqEssqD 9a4SsTS3KTZqtjLNbJ2DgchoRME75wWaOGXzqglkhtJZAuvqkJMe1IeauqEQlLuhJGmWQN CXfxEgkS8nq18pV8ddbWOyen440+NWFN/cv0d931Yjb7h5uE06+3EBsDJ2cBhzTViYB5EQ hRO2V7Ku1M/0pSRwvbyHCAz/v0nbbryY7Bw94ywyn2L8FVY+ESWxjN5GCmhL4A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787588995; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ud7Ydzkg4sHIKj+GwuzZq6P3iLWSqtLCs7Kt2F/MJKQ=; b=NxexudV4SfdPG8aZHX0YHreS/zdV+y+speFnYQhD5DukJrh8n6XMZNn9uhsTiO3W/qGbae WRvLBLmA8m5tsv+tBDslRkx0oyEfKZVtghwB36oZdZ6ZDXy4lheh7eLNmMls8vfwn4JwPl EdqGhAGdeizodi1Odi/B61r4KvyjVH3DQLBFQ4z8Frm4TkuelsWbEtQUN7IQcR/TARqtUS y7DZsApT0kxXqq7jcDZSWh5jkYwSf4Y+exaUNaRFndgK1pOWr+0kTGMmkiaArYwki6ys28 tNqcpKR718YmCykWoggMfpouDofJrmL9yvqhcQpVpvrqQnpp28Fh3htsjwvLJg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTGbR3k51z19Pb for ; Mon, 24 Aug 2026 16:29:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21199 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 24 Aug 2026 16:29:55 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 65e2c2279b62 - stable/15 - in_mcast: Fix uninitialized variable usage in inm_merge() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 65e2c2279b62dc4107f0a02b0570d35c9203d96f Auto-Submitted: auto-generated Date: Mon, 24 Aug 2026 16:29:55 +0000 Message-Id: <6a8c7183.21199.375b04ae@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=65e2c2279b62dc4107f0a02b0570d35c9203d96f commit 65e2c2279b62dc4107f0a02b0570d35c9203d96f Author: Mark Johnston AuthorDate: 2026-08-11 16:42:41 +0000 Commit: Mark Johnston CommitDate: 2026-08-24 15:17:54 +0000 in_mcast: Fix uninitialized variable usage in inm_merge() When the first loop in inm_merge() hits an error, generally because it hit some limit on the number of source filters for a multicast group, inm_merge() tries to atomically roll back changes to the group source filter list. To roll back, it iterates over the global source filter list for the multicast group, starting at the last entry that we updated ("nims"). But, if we have not yet updated any entries, this variable is uninitialized. Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM doesn't visit any source filters in this case. All of the above applies to the v6 case. Reported by: Daniel Birtwhistle MFC after: 1 week Sponsored by: The FreeBSD Foundation (cherry picked from commit b9db5a5b16477863654f92ec653e8464528ef981) --- sys/netinet/in_mcast.c | 1 + sys/netinet6/in6_mcast.c | 1 + 2 files changed, 2 insertions(+) diff --git a/sys/netinet/in_mcast.c b/sys/netinet/in_mcast.c index b5636c29daeb..032636417a0c 100644 --- a/sys/netinet/in_mcast.c +++ b/sys/netinet/in_mcast.c @@ -1023,6 +1023,7 @@ inm_merge(struct in_multi *inm, /*const*/ struct in_mfilter *imf) * Maintain a count of source filters whose state was * actually modified by this operation. */ + nims = NULL; RB_FOREACH(ims, ip_msource_tree, &imf->imf_sources) { lims = (struct in_msource *)ims; if (lims->imsl_st[0] == imf->imf_st[0]) nsrc0++; diff --git a/sys/netinet6/in6_mcast.c b/sys/netinet6/in6_mcast.c index 4ec9f36cd9ac..0489e656555a 100644 --- a/sys/netinet6/in6_mcast.c +++ b/sys/netinet6/in6_mcast.c @@ -1039,6 +1039,7 @@ in6m_merge(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf) * Maintain a count of source filters whose state was * actually modified by this operation. */ + nims = NULL; RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) { lims = (struct in6_msource *)ims; if (lims->im6sl_st[0] == imf->im6f_st[0]) nsrc0++;