From nobody Thu Oct 22 17:32:06 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j9Y9z0KBGz6xPRh for ; Thu, 22 Oct 2026 17:32:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j9Y9y3V5Fz3HCh for ; Thu, 22 Oct 2026 17:32:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690326; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pjE/672GxTU2i4jESa6fbpaKE+gY8XBm/3mPsdZKb+o=; b=rE3244R+16QXDbeab0ZRcHRVzOVICq4PUUfhwf2eE6lvPRpfzY+wlGRRErtoQBofgZWOBs 2+Uf3EmVtRyrEHJUbECJfi4pP0BvCHVkydf3JC2ECJiMOs/h7vdDhtt6xtVpwq9+xHK9Ky JHfK3Rod50oNlNgYJcZROMs+iqN5IsKNafkb7+4tAH5Wv7Dcj0+N5KHn0nsF82au4OfUvy TbZDDPvOFFr06f765LFh5NqzwePXEqnEf0ujns+/yRszcrM6omPkHLQm6x5BTD3ppQYkKn 1Nv2wUE72w2QfaUmI+QzQn74Eb7NpuMFGNHrihwqpCZg2lmPCnXPauF652L79Q== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792690326; b=CT6r94sCwwUQz770FM8WiBNBqoQ99R1dFXz5HJAruP/8PDYvqQWkH0Fv4WkJmZGLYBswoJ wTgwLuppB2eM6ghLbuCQ30RSYKqyARZ1MKqvHBlADJTUegLdKEO2NEWEDIWC9iCtbxSEYq Gcj8v4bwiFMLvgBlEV66rIrvw3vxgCgyYly/jEGooFIkuGXgwtI8ZR0L0SjJD7CKotod4x mwy/bFSNz1As4959/2BAbXJJGkuuihfYRtrhxSFqmomQAbkrJ9fNXTi+ee4NHIWbQBGtBL dTiHLcbfetOojuiV/KtKsb14scwFEsgoUaCpJ5wKC4KKnEEqUxX/QPAvdnEneg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690326; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pjE/672GxTU2i4jESa6fbpaKE+gY8XBm/3mPsdZKb+o=; b=xmq/4JEr6c/9ehozXH7RAcyQD6c+QLfefrXHKtv8WRXdF+FlsNv69YNpU0hH+oJDy90VNA STTYmOdXGxo43Dxpg9QJj/eVyxS3OihOGeprM5byEAojNHjWnOdhCXRjOCNpYF/sz0+yzT tHICZjXHW1otFBMIiBPUdeuR1vt7f6NmSFv6W/nyIXraBjTykRLBjxNlspNzxapV2NBZqx r+p3dZl5Li+1vBAhE4p95cDZ7vi1OkIJb7kOdz9fO6k9DfBCEb967v1RdD3win/hJKTQZ9 UBUnCvZBLP4X9faoiqFvMOeNUiQ+k4Bf/facwlmcuSYvSG2CaaPkWUuhx9kJ0g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j9Y9y2ymlzrjK for ; Thu, 22 Oct 2026 17:32:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3ef09 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 22 Oct 2026 17:32:06 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Andrew Griffiths From: Mark Johnston Subject: git: 8726bd5b3493 - stable/15 - tcp: Preserve borrowed ICMPv6 error mbufs List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 8726bd5b3493ccf2bac9d5c61feafa7fbf1f875f Auto-Submitted: auto-generated Date: Thu, 22 Oct 2026 17:32:06 +0000 Message-Id: <6ada4896.3ef09.a4dbc47@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8726bd5b3493ccf2bac9d5c61feafa7fbf1f875f commit 8726bd5b3493ccf2bac9d5c61feafa7fbf1f875f Author: Andrew Griffiths AuthorDate: 2026-10-05 13:14:38 +0000 Commit: Mark Johnston CommitDate: 2026-10-22 15:45:41 +0000 tcp: Preserve borrowed ICMPv6 error mbufs The TCP-over-UDP ICMP callback receives ip6c_m as a borrowed chain owned by icmp6_notify_error. It used m_pulldown() to obtain a contiguous UDP header even though that API frees the complete chain when the requested range is unavailable. The callback could then return without propagating the lost ownership, leaving raw ICMP delivery to read and free a stale head. Validate that the complete UDP header was quoted, copy it through the chain with m_copydata(), and temporarily advance the parser offset instead of consuming bytes from the caller-owned packet. A remote sender can reach the old path when TCP UDP tunneling is enabled by quoting the configured local UDP source port in an ICMPv6 error and including only four through seven UDP-header bytes. Signed-off-by: Andrew Griffiths Reviewed by: pouria, tuexen, markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D60143 (cherry picked from commit 80af0a32e48bff6ad97e768b16d2dbc01ac8d1c3) --- sys/netinet/tcp_subr.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index 989cbd2a3a33..5cccb1e91d0b 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -3377,25 +3377,21 @@ static void tcp6_ctlinput_viaudp(udp_tun_icmp_param_t param) { struct ip6ctlparam *ip6cp = param.ip6cp; - struct mbuf *m; - struct udphdr *udp; + struct udphdr udp; uint16_t port; - m = m_pulldown(ip6cp->ip6c_m, ip6cp->ip6c_off, sizeof(struct udphdr), NULL); - if (m == NULL) { + if (ip6cp->ip6c_m->m_pkthdr.len < + ip6cp->ip6c_off + sizeof(struct udphdr)) return; - } - udp = mtod(m, struct udphdr *); - if (ntohs(udp->uh_sport) != V_tcp_udp_tunneling_port) { + m_copydata(ip6cp->ip6c_m, ip6cp->ip6c_off, sizeof(udp), + (caddr_t)&udp); + if (ntohs(udp.uh_sport) != V_tcp_udp_tunneling_port) return; - } - port = udp->uh_dport; - m_adj(m, sizeof(struct udphdr)); - if ((m->m_flags & M_PKTHDR) == 0) { - ip6cp->ip6c_m->m_pkthdr.len -= sizeof(struct udphdr); - } + port = udp.uh_dport; + ip6cp->ip6c_off += sizeof(struct udphdr); /* Now call in to the normal handling code */ tcp6_ctlinput_with_port(ip6cp, port); + ip6cp->ip6c_off -= sizeof(struct udphdr); } #endif /* INET6 */