From nobody Tue Aug 11 17:12:25 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hKJ8T53qpz6p2Cd for ; Tue, 11 Aug 2026 17:12:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hKJ8T1sVJz3V5w for ; Tue, 11 Aug 2026 17:12:25 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786468345; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iz+u5Ktlj3fsCKibjZm1OnBwcc2kCxhSygJjWFa+qF8=; b=Y6as/y+13Ja4lpBPNm2Lx/0HRP9S6Exb1SMvU4UY+uLwHCsYy0He+sLJ7Yq53nZiDGO78x QEkHXkapQ5oG72cWPdHLD8/LIawHxCPNwqOfOQetkaLGGNGVTHweYWBkuLyaup/5X0g8Io dqKuDNBsVl5FkKu0tSRJAF5qaRjDz2Pv8Gr7Hh7XAe7A2gHEczqbgODEH7PFgOEx7iJxSs Uere8gPrqi33XZBf/SNHTd1KnWiF92JoMoFah20ZHmJovM/mB6f5aeyOjK3Y/XA/YKswdJ epZ0RVkW5nb0SNhg69fuGjZN/kUh8hIvU3tNyb91ouZrO1DJ5Vbls8LViXNr5w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786468345; a=rsa-sha256; cv=none; b=QFKytKns0s7NZ/X8uWGp69n+V42ARflBLrQvA+VhWoAHFz5iDC0oPfw0r1FDgef+jnddz5 5btnRT7le6oR62rDdoehX+/hNdrCrcd3tOfnsdLQt1jm9BA0DryIjRyNyZkMZPWjTth8aT ZwiF/LgSLe+GRifFIjbFWNeUP67axcWqi1VJ0243EW1/eBtzUnQIXXe5QNWOUdmzgjgP8H DuvYhozPqao/h6ToWhn5UY+vyahwt8t6q32QbXejFZMqpMvaQDDvnd4/sA0SqQTfE1f6R5 d6U6ID1pZojyeAFtK5IlBSAZ/iLzdM5jd1CDq+9haOM18YPKvLkmO1rPMU1/SQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786468345; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iz+u5Ktlj3fsCKibjZm1OnBwcc2kCxhSygJjWFa+qF8=; b=ozKsxLfY9jDNL31DI1mgFm0EEhbZvY7rJ7OjjpfCL6T64uyt8vTak/b4jCibuaP9EWHyPM a8IB3RheQ3D0ArpJFINtM9bp++Aa8nxIW4JvJTgaqd1kAY38TJuj38TfE1/zDoRvofwjsf dUhYCPMJF648fcJXqYMT9+WqUUU4VHydbz6ootf5lOsKlOvLusR3ol8Z9OR04lL5Gafyu8 lOZ/CKuxibb73BqpIvFfsc1IFsQ/jnqKk/0U3dB0f1vvjTnmgmXYSpkG8GyWKu9kRotO7v thXjxKNPJ7JAThxvvb9hEMqeRiORKQv7jEQuA5Wbm5E/JPvzRTKIi7iyx2ZJVA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hKJ8T0Q5Wz148Y for ; Tue, 11 Aug 2026 17:12:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3fa87 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 11 Aug 2026 17:12:25 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: b9db5a5b1647 - main - in_mcast: Fix uninitialized variable usage in inm_merge() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b9db5a5b16477863654f92ec653e8464528ef981 Auto-Submitted: auto-generated Date: Tue, 11 Aug 2026 17:12:25 +0000 Message-Id: <6a7b57f9.3fa87.600c5f05@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=b9db5a5b16477863654f92ec653e8464528ef981 commit b9db5a5b16477863654f92ec653e8464528ef981 Author: Mark Johnston AuthorDate: 2026-08-11 16:42:41 +0000 Commit: Mark Johnston CommitDate: 2026-08-11 17:02:40 +0000 in_mcast: Fix uninitialized variable usage in inm_merge() When the first loop in inm_merge() hits an error, generally because it hit some limit on the number of source filters for a multicast group, inm_merge() tries to atomically roll back changes to the group source filter list. To roll back, it iterates over the global source filter list for the multicast group, starting at the last entry that we updated ("nims"). But, if we have not yet updated any entries, this variable is uninitialized. Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM doesn't visit any source filters in this case. All of the above applies to the v6 case. Reported by: Daniel Birtwhistle MFC after: 1 week Sponsored by: The FreeBSD Foundation --- sys/netinet/in_mcast.c | 1 + sys/netinet6/in6_mcast.c | 1 + 2 files changed, 2 insertions(+) diff --git a/sys/netinet/in_mcast.c b/sys/netinet/in_mcast.c index ad908b72c340..e81096859770 100644 --- a/sys/netinet/in_mcast.c +++ b/sys/netinet/in_mcast.c @@ -1018,6 +1018,7 @@ inm_merge(struct in_multi *inm, /*const*/ struct in_mfilter *imf) * Maintain a count of source filters whose state was * actually modified by this operation. */ + nims = NULL; RB_FOREACH(ims, ip_msource_tree, &imf->imf_sources) { lims = (struct in_msource *)ims; if (lims->imsl_st[0] == imf->imf_st[0]) nsrc0++; diff --git a/sys/netinet6/in6_mcast.c b/sys/netinet6/in6_mcast.c index 036d58e5bd92..49b0537454df 100644 --- a/sys/netinet6/in6_mcast.c +++ b/sys/netinet6/in6_mcast.c @@ -1042,6 +1042,7 @@ in6m_merge(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf) * Maintain a count of source filters whose state was * actually modified by this operation. */ + nims = NULL; RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) { lims = (struct in6_msource *)ims; if (lims->im6sl_st[0] == imf->im6f_st[0]) nsrc0++;