From nobody Mon Oct 26 19:46:59 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jD3zl663jz6xWl4 for ; Mon, 26 Oct 2026 19:46:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jD3zl2jSVz4qhD for ; Mon, 26 Oct 2026 19:46:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793044019; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=R+4CEbTG2Aa+sWcr8N3vsZZhnl+2Ca09Xp3NcPKuSYU=; b=u45KZ8KplVSB0p/M3OvJhxf+bKS2/8hIVPPdXLtSJYWeKj48N4m2rrwoLYd+GttPGnUQYG zTK7P1GD7e8c8BiBDneZ2W2i15XNz6HBtX9UHCYzs3Iy2oTd/u4jm+CZfzjNHakFCY1MKI mxA7+JGAErBKtFVL7qTzsqQZPDytqG8aUATiKHO2bho/ANPIV1tvU3qwZm8ic7OGBgpuIP vb4vjFx5KPIEne/1d9oHeM6ceQr9XJyTv1DzMi0HuZ6M+MqCFkDsRz6j589g8wtaV6uCL9 K2xnBmGgiLYj0Ee1DNlUXa7RoLgDiKsDJlcCVYBghm96UFINKwpPiuta8+TPmQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793044019; b=hGFGQjQLtVib6LFW6yntaBLn40di61crwt/6NHGvW4LeHDMxo0Q4y+KD2PJdRQY8Yiez3U eZTyXk5v4WbFV4OT7Sei6fo+K00JmEW94t+Fke7ywtzpCKKDI56bFTaAHY9206sbGBjrU5 i3omS1hddPVV4h4GgGmiHK71h70xhVYYun93yhKK5LZbMOKmRcujYa1lS3knnEVNvrMwz4 TjPzvpdqz2QYUj74PVYiWfsfT+TwYziSMx9TJZo/c8b4HuQTczLSR43pdCkWuHcd7jQRJJ 1YqEcX3iT837gEKdu6SkQcUV3LzcDcCOOZJczQjNupXgPvDaiFpd4zUPxgwFNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793044019; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=R+4CEbTG2Aa+sWcr8N3vsZZhnl+2Ca09Xp3NcPKuSYU=; b=ppgHt9GT/3Ij+qOW4LlQtAn5OkRbI8vfcSx2AKbapO+LCuuccbS2S63Dlha4Xx3G0AkofN mzRnlMcWAJm7acsT7rEGtLoU6gXc9ppkjDRgNJbuBYlXGeXQNZf0KROVn8rZFUHi2WXk78 pHAbk5ezlmaePB/Nj7P6IYWVSMBTiRQpyuL+jRLdxe2ekwVK5+sgT1oYYdk7s0hkuR2DK7 Eg33v6RFGKt/Wu5FtjktfxFu1yLq945S2HEy5v1rKISPk0bkNpiNJr1W4loVdq3K1ugWbh YHqar34mVJwDVVC1OIsfnTh/kNRmesC1al+Pd+kOhFS1bZlU+1Q4uN7lpQ8V7w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jD3zl2NQVzpPW for ; Mon, 26 Oct 2026 19:46:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 39492 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 26 Oct 2026 19:46:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Andrew Griffiths From: Mark Johnston Subject: git: 8738545c54fe - stable/14 - tcp: Preserve borrowed ICMPv6 error mbufs List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 8738545c54fefc411ceb80242274fc94f9063051 Auto-Submitted: auto-generated Date: Mon, 26 Oct 2026 19:46:59 +0000 Message-Id: <6adfae33.39492.267683d2@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8738545c54fefc411ceb80242274fc94f9063051 commit 8738545c54fefc411ceb80242274fc94f9063051 Author: Andrew Griffiths AuthorDate: 2026-10-05 13:14:38 +0000 Commit: Mark Johnston CommitDate: 2026-10-26 14:12:15 +0000 tcp: Preserve borrowed ICMPv6 error mbufs The TCP-over-UDP ICMP callback receives ip6c_m as a borrowed chain owned by icmp6_notify_error. It used m_pulldown() to obtain a contiguous UDP header even though that API frees the complete chain when the requested range is unavailable. The callback could then return without propagating the lost ownership, leaving raw ICMP delivery to read and free a stale head. Validate that the complete UDP header was quoted, copy it through the chain with m_copydata(), and temporarily advance the parser offset instead of consuming bytes from the caller-owned packet. A remote sender can reach the old path when TCP UDP tunneling is enabled by quoting the configured local UDP source port in an ICMPv6 error and including only four through seven UDP-header bytes. Signed-off-by: Andrew Griffiths Reviewed by: pouria, tuexen, markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D60143 (cherry picked from commit 80af0a32e48bff6ad97e768b16d2dbc01ac8d1c3) --- sys/netinet/tcp_subr.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index 31f52cbebffa..3df756f23d49 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -3201,25 +3201,21 @@ static void tcp6_ctlinput_viaudp(udp_tun_icmp_param_t param) { struct ip6ctlparam *ip6cp = param.ip6cp; - struct mbuf *m; - struct udphdr *udp; + struct udphdr udp; uint16_t port; - m = m_pulldown(ip6cp->ip6c_m, ip6cp->ip6c_off, sizeof(struct udphdr), NULL); - if (m == NULL) { + if (ip6cp->ip6c_m->m_pkthdr.len < + ip6cp->ip6c_off + sizeof(struct udphdr)) return; - } - udp = mtod(m, struct udphdr *); - if (ntohs(udp->uh_sport) != V_tcp_udp_tunneling_port) { + m_copydata(ip6cp->ip6c_m, ip6cp->ip6c_off, sizeof(udp), + (caddr_t)&udp); + if (ntohs(udp.uh_sport) != V_tcp_udp_tunneling_port) return; - } - port = udp->uh_dport; - m_adj(m, sizeof(struct udphdr)); - if ((m->m_flags & M_PKTHDR) == 0) { - ip6cp->ip6c_m->m_pkthdr.len -= sizeof(struct udphdr); - } + port = udp.uh_dport; + ip6cp->ip6c_off += sizeof(struct udphdr); /* Now call in to the normal handling code */ tcp6_ctlinput_with_port(ip6cp, port); + ip6cp->ip6c_off -= sizeof(struct udphdr); } #endif /* INET6 */