git: c8a5df48de6f - main - udp: don't leak mbuf if tunnel didn't consume and inpcb is gone

From: Gleb Smirnoff <glebius_at_FreeBSD.org>
Date: Mon, 01 Sep 2025 16:33:53 UTC
The branch main has been updated by glebius:

URL: https://cgit.FreeBSD.org/src/commit/?id=c8a5df48de6f2c5fada622af043f3c3fca88fca1

commit c8a5df48de6f2c5fada622af043f3c3fca88fca1
Author:     Gleb Smirnoff <glebius@FreeBSD.org>
AuthorDate: 2025-09-01 16:33:24 +0000
Commit:     Gleb Smirnoff <glebius@FreeBSD.org>
CommitDate: 2025-09-01 16:33:24 +0000

    udp: don't leak mbuf if tunnel didn't consume and inpcb is gone
    
    Fixes:  e1751ef896119d7372035b1b60f18a6342bd0e3b
    
    Reviewed by:            tuexen, kp, markj
    Differential Revision:  https://reviews.freebsd.org/D52170
---
 sys/netinet/udp_usrreq.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 3e6519118a40..4547699b6df5 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -258,8 +258,11 @@ udp_append(struct inpcb *inp, struct ip *ip, struct mbuf *n, int off,
 		filtered = (*up->u_tun_func)(n, off, inp, (struct sockaddr *)&udp_in[0],
 		    up->u_tun_ctx);
 		INP_RLOCK(inp);
-		if (in_pcbrele_rlocked(inp))
+		if (in_pcbrele_rlocked(inp)) {
+			if (!filtered)
+				m_freem(n);
 			return (1);
+		}
 		if (filtered) {
 			INP_RUNLOCK(inp);
 			return (1);