From nobody Thu Oct 29 06:03:21 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jFYZ14dNMz6xrJZ for ; Thu, 29 Oct 2026 06:03:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jFYZ12sbwz4sqP for ; Thu, 29 Oct 2026 06:03:21 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793253801; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WxkegMvMUiEisnmoWTzpHiE8v8IZOdqXw+7sxznASAg=; b=xkPnAnnlOiMJYsCLVCcaUf8XErhXIEpf3f78UrWXnAkLfQGXvOvDlQ5RpbzUHMkAl7CKPq 6A2XEqIIlKeRqM1UvjKrPHlt1oSeU93AZkV+ombyuQdzt+omSlIJS5CErUxL0Dc+rRvBJF F1jf2X/toUXkGvdafLRn2rY5+615wp2YOirxqRtDMeVNVUffwID2dudZp6eM2kJ3fPDQRD vRclyuqnUsLS1w++yXrOMbe/IFCYt/yiiZI6PkNLX1MDp00QR0J2LMAw3BVuXFqvoPc9OJ fMq0WIMXgZRIEjQpHKooAqkj3x/vI8bK6gPB6ykR9Ew3J+5UwVinYy1ja5Omug== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793253801; b=GFm80EojFfVMOLVeauRtP3VF8ziXj+DYZ8nvyZHwF2PIdB30YsE1gmd8dNMHstCQOT6sUI rcqB0JgNl37MAwx4lwb/SJDax9tmtHmrZIlKY/rPrdWGjtD63Mc3nbwRKZGWi5O+mteTVF D4GlHjdNXjkfoO2CsTMwsUZciKY0PTrxyG6pWPt3zuyuYSTL3GHtiDK9Ph74Genlpc9lMx gpQtSI+JORCFQhfzZ0bA7J80pPS+/Zkg8ZeNQjXK4orUcU8lblR7p4T2GShUicpDV0i8K6 D2UjRv4MJLsab5qkvS4wiMwJfJOwJqxW96ehVrpwd8eZxBZOmX6BXK6k6gsSMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793253801; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WxkegMvMUiEisnmoWTzpHiE8v8IZOdqXw+7sxznASAg=; b=ZRGnGrpa3IvYUUC8gS6+18vfh2A8bAGZZqAoG7VQ0M/CZf3hbo/YBMqREADg0MYQzpylkC rOoWWiXw+iQeOdi8scPxrjkN4OC7hTLWVpwVOMMK5JKmHXk9UUHXTb6wUpFoxrCFk7kuCn zhiCT6mw8kTolrR5G3ARbBCttU7CCiTwJHtG7ebOhBDMhzsiu99n3I9YZ5xCpAZWfwaOAU ZUWQMFshtH2XnZwEZxDo89xR9YByU7i31mcOX6thcSLmIs+8bc5xweTLTxntxR+CkRoBNf CmadeiCUvasEQvONJeCKimpaM4uu1NVDL1akpbyTJrQvvDRu3Lew8qSfWmiYDw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jFYZ12XFnzPsj for ; Thu, 29 Oct 2026 06:03:21 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3a60f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 29 Oct 2026 06:03:21 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: R. Christian McDonald From: Kevin Bowling Subject: git: cd9c36b40e2e - stable/15 - iflib: Do not pull up trailing IPv4 fragments to the L4 header List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kbowling X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: cd9c36b40e2e2d7df2149f2e929ae5c77994f8bc Auto-Submitted: auto-generated Date: Thu, 29 Oct 2026 06:03:21 +0000 Message-Id: <6ae2e1a9.3a60f.68555b3e@gitrepo.freebsd.org> The branch stable/15 has been updated by kbowling: URL: https://cgit.FreeBSD.org/src/commit/?id=cd9c36b40e2e2d7df2149f2e929ae5c77994f8bc commit cd9c36b40e2e2d7df2149f2e929ae5c77994f8bc Author: R. Christian McDonald AuthorDate: 2026-10-23 18:28:29 +0000 Commit: Kevin Bowling CommitDate: 2026-10-29 05:38:11 +0000 iflib: Do not pull up trailing IPv4 fragments to the L4 header iflib_parse_header() pulls every IPv4 packet up to the end of the TCP or UDP header, including fragments at a non-zero offset, which carry no L4 header at all. A trailing fragment shorter than that header (1-7 bytes of UDP, 1-19 bytes of TCP) makes m_pullup() fail and the frame is freed without a trace in the interface counters. Only parse the L4 header on the first fragment. TSO never produces fragments, so assert that. With a 1500-byte MTU every UDP datagram of 1473-1479 bytes is lost behind a forwarding host whose ingress NIC sets receive checksum flags, or on any VLAN with hardware tagging. SIP over UDP is a common victim. Reported by: Alex Roberts Reviewed by: gallatin Fixes: c224b2ce7de0 ("iflib: don't pullup UDP payloads to the TCP header size") See also: https://redmine.pfsense.org/issues/17196 Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit f1726686cb31ff141e507760124f44442c9f141a) --- sys/net/iflib.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/sys/net/iflib.c b/sys/net/iflib.c index e639343b93f5..51491cce928e 100644 --- a/sys/net/iflib.c +++ b/sys/net/iflib.c @@ -3675,7 +3675,7 @@ iflib_parse_header(iflib_txq_t txq, if_pkt_info_t pi, struct mbuf **mp) case ETHERTYPE_IP: { struct ip *ip; - struct tcphdr *th; + struct tcphdr *th = NULL; uint8_t hlen; hlen = pi->ipi_ehdrlen + sizeof(*ip); @@ -3686,7 +3686,13 @@ iflib_parse_header(iflib_txq_t txq, if_pkt_info_t pi, struct mbuf **mp) } ip = (struct ip *)(m->m_data + pi->ipi_ehdrlen); hlen = pi->ipi_ehdrlen + (ip->ip_hl << 2); - if (ip->ip_p == IPPROTO_TCP) { + if ((ip->ip_off & htons(IP_OFFMASK)) != 0) { + /* + * Only the first fragment carries the TCP/UDP header, + * so do not extend hlen beyond the IP header. + */ + MPASS(!IS_TSO4(pi)); + } else if (ip->ip_p == IPPROTO_TCP) { hlen += sizeof(*th); th = (struct tcphdr *)((char *)ip + (ip->ip_hl << 2)); } else if (ip->ip_p == IPPROTO_UDP) { @@ -3698,7 +3704,8 @@ iflib_parse_header(iflib_txq_t txq, if_pkt_info_t pi, struct mbuf **mp) return (ENOMEM); /* reset pointers after pullup */ ip = (struct ip *)(m->m_data + pi->ipi_ehdrlen); - th = (struct tcphdr *)((char *)ip + (ip->ip_hl << 2)); + if (th != NULL) + th = (struct tcphdr *)((char *)ip + (ip->ip_hl << 2)); } pi->ipi_ip_hlen = ip->ip_hl << 2; pi->ipi_ipproto = ip->ip_p; @@ -3707,7 +3714,7 @@ iflib_parse_header(iflib_txq_t txq, if_pkt_info_t pi, struct mbuf **mp) /* TCP checksum offload may require TCP header length */ if (IS_TX_OFFLOAD4(pi)) { - if (__predict_true(pi->ipi_ipproto == IPPROTO_TCP)) { + if (__predict_true(th != NULL)) { pi->ipi_tcp_hflags = tcp_get_flags(th); pi->ipi_tcp_hlen = th->th_off << 2; pi->ipi_tcp_seq = th->th_seq;