From nobody Wed Oct 28 20:35:57 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jFJzL3V3Wz6x6Jn for ; Wed, 28 Oct 2026 20:35:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jFJzK6Dthz4RSC for ; Wed, 28 Oct 2026 20:35:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793219757; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=f4FFTNM8zncBORPRgUIZQ7TZ2o20QfspJAHdA+xwc40=; b=jx+O3fyDS/MK9a5PrdcqtEJZKSnZmgScOXHcCoMiUTj2uI5RW6uekeqDoSH4Tlhinn/wB0 oYtOKqV3wcBZruHPbz2BApN9ww2Bk2S85Lq53Cn1DyrNF6d2JOmA/4MpgArpukigdrcNlv AtKYh3zBWFnhCBTiVqMP+5I2fd/lGYb0EEtDcCtx2w5EUME9T4+EZC07Om1zUUmKXIhCBb WYWgh92u+AG9KE/WcY3AecXm1jFeatz+/Na1u5tsQaswUb5bUDoxbK6st9n5NrAA0/5OX/ kv7K5sPp5HE5N9LaOp1W/eNl0YoBI9JMR0LiWafQqATFWDIVWaJsPSMs84bSwg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793219757; b=NaKuP3MzHKazSLUl4Yfuvu/HrIMtQLdekVPubNe45dEzGZXO99Lday/ZTkSGsSWOuswU7g U2omg7qhnEd4yw/Q/hHT4F6TVCoT5ideYq+6ghVcUXI2HEjtNf1lc1mfaxstrRHWC+/Rb0 ZHPCsP1InG1Nz9TuaHYBxSR2NTie2nVWx8YW4zZtzEs/KM/27r+VSR9t2FK7bIHZE9qAqQ izbRdEDbD4hHpCD23d7T4KlLX4dToGlXJSU0yBK3CM7ooebFqQeqIOtN2L0+i6n2LfESzn jnVUqBgB9gB3uhFvbOO/EOdKXPgHxYXO2sWxPLPPcQEDHglPPHC4Jed5q0NPKw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793219757; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=f4FFTNM8zncBORPRgUIZQ7TZ2o20QfspJAHdA+xwc40=; b=KYCPkM6XOmprhFruiK/qhEs8NoPiwEK55xozXUaeoBqDJB/BPwAJ9+c3IgElUo7aJx2K24 +J/oTli2Y71KsQDemqLXftX+GhxjQyaRERzoChSNecz/7jIOG4b2MdIu4CIa8jrsx2BbPf s6cXCb/7mUBkeQmiJNOrH3oruIJrwRTkgZS4nVJebK8AtWqsdyCBn41VxgqSvFhmHy1SAZ agfYmLkYk/tGC7s7e4PbjSboWH6YCxSJsE4+yDb0cX37zTJ1pe3OiN0j7J/1b9sKZHTn/u welK4kD5xLNhvV0HaCIx+tOSFSor8FzMWh3ZLJrrcFjnYZQwiYAIwC1tqeyx+Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jFJzK1Wpnz1N4s for ; Wed, 28 Oct 2026 20:35:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1d8e4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 28 Oct 2026 20:35:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: R. Christian McDonald Subject: git: b27a0b8bfb15 - stable/15 - pf: Free a table entry that cannot be routed List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: b27a0b8bfb151543c42b5d899327bf7168dc5f37 Auto-Submitted: auto-generated Date: Wed, 28 Oct 2026 20:35:57 +0000 Message-Id: <6ae25cad.1d8e4.b8653af@gitrepo.freebsd.org> The branch stable/15 has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=b27a0b8bfb151543c42b5d899327bf7168dc5f37 commit b27a0b8bfb151543c42b5d899327bf7168dc5f37 Author: R. Christian McDonald AuthorDate: 2026-10-13 15:53:00 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-28 20:34:14 +0000 pf: Free a table entry that cannot be routed pfr_insert_kentry() returned the error of pfr_route_kentry() and leaked the entry it had created; pfr_insert_kentries() stopped at the first entry it could not route and leaked it and the rest of the work queue, which no caller frees. Destroy an entry that cannot be routed and go on with the next. Reviewed by: kp MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D60532 (cherry picked from commit 989d72fd3d35daa6a056afdd0c6b0aba4c5d8ccf) --- sys/netpfil/pf/pf_table.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sys/netpfil/pf/pf_table.c b/sys/netpfil/pf/pf_table.c index 1785e8a78d31..85820a65f290 100644 --- a/sys/netpfil/pf/pf_table.c +++ b/sys/netpfil/pf/pf_table.c @@ -846,15 +846,16 @@ static void pfr_insert_kentries(struct pfr_ktable *kt, struct pfr_kentryworkq *workq, time_t tzero) { - struct pfr_kentry *p; + struct pfr_kentry *p, *q; int rv, n = 0; - SLIST_FOREACH(p, workq, pfrke_workq) { + SLIST_FOREACH_SAFE(p, workq, pfrke_workq, q) { rv = pfr_route_kentry(kt, p); if (rv) { printf("pfr_insert_kentries: cannot route entry " "(code=%d).\n", rv); - break; + pfr_destroy_kentry(p); + continue; } p->pfrke_counters.pfrkc_tzero = tzero; n++; @@ -876,8 +877,10 @@ pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, time_t tzero) return (ENOMEM); rv = pfr_route_kentry(kt, p); - if (rv) + if (rv) { + pfr_destroy_kentry(p); return (rv); + } p->pfrke_counters.pfrkc_tzero = tzero; kt->pfrkt_cnt++;