From nobody Wed Oct 28 20:41:36 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jFK5s3bJLz6x721 for ; Wed, 28 Oct 2026 20:41:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jFK5r6cTjz4bB1 for ; Wed, 28 Oct 2026 20:41:36 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793220096; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BklvcOiQe5JbpI10XJG4J1cq+LpUfCizV9+AgW9D/4E=; b=klWSo3kPZ+tDV1HkWeBsURn+Kvh8OmC7AAxmZxSS2xV61IONGedYIYg/QncIMGzpxt9XSX iQO7I+6ynXEOQ6IflTQr/FDGrNGc4+JA8yQbDfL92xQGi1pTovTnn/f6jrI6At9IDuZIvz j7jm8Lix/+yIo09OwWkeoBe59/+UJeNS74viPtCOxCqdo5qiQ+p8Tp7NEE1wiPAbklLOy1 oElSigKmAjZ2nkqlG2PAlsEgObWKvAo2OprdvH7KBK4CrGjNCqCvf+CTwxupXaYkTximJc FV77AaJZ5WEqQgsv9mRgyqhkF5zHXsEA+Q6Rjg8iGMDggXH/phf0sp6KZa2nDw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793220096; b=sjXDQO558ZatQODJ3G8jTzHT2/OQ/JKjtk3GEH1xCKCGKSm0HGxKDkp90FL82P0UAH4KJ5 PxwkrMsFGMvWPb7XZjLCuC+0g5zGJPPcDTHiQTn4yMuFJljdVWUJ7hWoehqr6pmbiqhkno RdMXZ9K34PAilY2eaRSpuyCVVw+YQsl0IxhnxCgzoY1uJUD8UPFTQB563jxbFGKUd+0cLg DbQagXR5L1QLhLrvFkI68omqqyHX65PgY8YZQIv+Ridi7PzCAwCc1xlXwMv3TirpVCjcvL WYSUqLTvA4V2Yu9tf8jCGd0SsnVlPypm4D2PMFS41VVqLwTcjEm1wU5+dY4R8A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793220096; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BklvcOiQe5JbpI10XJG4J1cq+LpUfCizV9+AgW9D/4E=; b=QnXAkhuV9Pwqm0EQ8QB7dPcTFhATrfxMC/EQlj9E5aqj1lbKphxHvU3aGgZrqnhmwIc1ak fGOwbCe3XivlS2SxvFdkBCdda7k/VsfuNaGfBJOGXJSS0o7OG/9lTVgnYbBRAzYMIfW5SO 1vCoczqCxjyg50+FejINPlkbHnxZYG28y11NU/Jadpaexn2uRxusYQ92Gr+OdeCsRndWnZ fjuG6oqThYrF/JiTmLxVaZN6rADZRPNFbVMMunWtod/sDmO6B495UessfNViJGJw4NOUAd EWvGYWovEriLfQUbpC4W/2JAxFpMO6vPHIv+cHcR947VyhneWrRnVvfHrnb+Nw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jFK5r6H3Mz1MFp for ; Wed, 28 Oct 2026 20:41:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1f051 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 28 Oct 2026 20:41:36 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: R. Christian McDonald Subject: git: 917f39f3d6a3 - stable/14 - pf: Free a table entry that cannot be routed List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 917f39f3d6a36b066901fd7d483a56562ba8051e Auto-Submitted: auto-generated Date: Wed, 28 Oct 2026 20:41:36 +0000 Message-Id: <6ae25e00.1f051.3f4b7d87@gitrepo.freebsd.org> The branch stable/14 has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=917f39f3d6a36b066901fd7d483a56562ba8051e commit 917f39f3d6a36b066901fd7d483a56562ba8051e Author: R. Christian McDonald AuthorDate: 2026-10-13 15:53:00 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-28 20:38:09 +0000 pf: Free a table entry that cannot be routed pfr_insert_kentry() returned the error of pfr_route_kentry() and leaked the entry it had created; pfr_insert_kentries() stopped at the first entry it could not route and leaked it and the rest of the work queue, which no caller frees. Destroy an entry that cannot be routed and go on with the next. Reviewed by: kp MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D60532 (cherry picked from commit 989d72fd3d35daa6a056afdd0c6b0aba4c5d8ccf) --- sys/netpfil/pf/pf_table.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sys/netpfil/pf/pf_table.c b/sys/netpfil/pf/pf_table.c index a064aca5bebe..6a1a3cc48306 100644 --- a/sys/netpfil/pf/pf_table.c +++ b/sys/netpfil/pf/pf_table.c @@ -841,15 +841,16 @@ static void pfr_insert_kentries(struct pfr_ktable *kt, struct pfr_kentryworkq *workq, long tzero) { - struct pfr_kentry *p; + struct pfr_kentry *p, *q; int rv, n = 0; - SLIST_FOREACH(p, workq, pfrke_workq) { + SLIST_FOREACH_SAFE(p, workq, pfrke_workq, q) { rv = pfr_route_kentry(kt, p); if (rv) { printf("pfr_insert_kentries: cannot route entry " "(code=%d).\n", rv); - break; + pfr_destroy_kentry(p); + continue; } p->pfrke_counters.pfrkc_tzero = tzero; n++; @@ -871,8 +872,10 @@ pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero) return (ENOMEM); rv = pfr_route_kentry(kt, p); - if (rv) + if (rv) { + pfr_destroy_kentry(p); return (rv); + } p->pfrke_counters.pfrkc_tzero = tzero; kt->pfrkt_cnt++;